比如日志
{"release_time": "1998-01-01", "home_url": "http://www.777.com/show_page/id_001.html", "isVip": "", "channel": "777"}
{"release_time": "2009", "home_url": "http://www.666.com/show_page/id_002.html", "isVip": "true", "channel": "666"}
{"release_time": "", "home_url": "http://www.666.com/show_page/id_003.html", "isVip": "", "channel": "666"}
我需要将releas_time固定设置为string, isVip也为strint
我在filter中使用了
mutate {
convert => { "rating" => "float" }
convert => { "release_time" => "string" }
convert => { "isVip" => "string" }
}
logstash日志报错:
"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [release_time]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"\""
curl -XGET http://localhost:9200/test-a-2016.05.12 看到
...
"release_time":{"type":"date","format":"strict_date_optional_time||epoch_millis"
{"release_time": "1998-01-01", "home_url": "http://www.777.com/show_page/id_001.html", "isVip": "", "channel": "777"}
{"release_time": "2009", "home_url": "http://www.666.com/show_page/id_002.html", "isVip": "true", "channel": "666"}
{"release_time": "", "home_url": "http://www.666.com/show_page/id_003.html", "isVip": "", "channel": "666"}
我需要将releas_time固定设置为string, isVip也为strint
我在filter中使用了
mutate {
convert => { "rating" => "float" }
convert => { "release_time" => "string" }
convert => { "isVip" => "string" }
}
logstash日志报错:
"error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [release_time]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"\""
curl -XGET http://localhost:9200/test-a-2016.05.12 看到
...
"release_time":{"type":"date","format":"strict_date_optional_time||epoch_millis"
2 个回复
三斗室 - ELK
赞同来自: auroracxy
flank
赞同来自: auroracxy