logstash匹配路径字段

柔光的暖阳◎ 2023-02-13 03:48 1阅读 0赞

### 方法一：使用grok插件 ###

**1. d:/usr2/local/etc/logstash/pipeline1目录下logstash.conf配置文件**

input { 
        stdin { } 
    }
    
    filter {
        grok {
            # 匹配路徑 /usr/share/filebeat/log/apps/butler/filebeat5.log中的butler
            match => {message => "^/%{DATA}/%{DATA}/%{DATA}/%{DATA}/%{DATA}/%{DATA:path}/%{DATA}"}
        }
    }
    
    output {
    	stdout { codec => rubydebug }
    }

**2. 启动脚本**

docker run --rm -it -v /d/usr2/local/etc/logstash/pipeline1:/usr/share/logstash/pipeline --name logstash1 -p 9600:9600 logstash:7.7.0

**3. 控制台输入内容，查看结果**

/usr/share/filebeat/log/apps/butler/filebeat2.log

![20200527112431124.png][]

### 方法二：使用ruby、mutate插件 ###

**1. logstash.conf配置文件修改为**

input { 
        stdin { } 
    }
    
    filter {
        ruby {
            code => '
                event.set("components", event.get("message").split("/"))
            '
        }
        if [components][6] {
            mutate {
                add_field => {"path1" => "%{[components][6]}"}
                remove_field => [components]
            }
        }
    }
    
    output {
    	stdout { codec => rubydebug }
    }

**2. 启动脚本**

docker run --rm -it -v /d/usr2/local/etc/logstash/pipeline1:/usr/share/logstash/pipeline --name logstash1 -p 9600:9600 logstash:7.7.0

**3. 控制台输入内容，查看结果**

/usr/share/filebeat/log/apps/butler/filebeat2.log

![20200527112929201.png][]

### 方法三：使用ruby插件 ###

**1. logstash.conf配置文件修改为**

input { 
        stdin { } 
    }
    
    filter {
        ruby {
            code => '
                event.set("path2", event.get("message").split("/")[-2])
            '
        }
    }
    
    output {
    	stdout { codec => rubydebug }
    }

**2. 启动脚本**

docker run --rm -it -v /d/usr2/local/etc/logstash/pipeline1:/usr/share/logstash/pipeline --name logstash1 -p 9600:9600 logstash:7.7.0

**3. 控制台输入内容，查看结果**

/usr/share/filebeat/log/apps/butler/filebeat2.log

![20200527113153523.png][]

[20200527112431124.png]: https://img-blog.csdnimg.cn/20200527112431124.png
[20200527112929201.png]: https://img-blog.csdnimg.cn/20200527112929201.png
[20200527113153523.png]: https://img-blog.csdnimg.cn/20200527113153523.png