Filebeat默认nginx模块添加了request_time,请问怎么将该字段修改为number类型?
Beats | 作者 melody65 | 发布于2020年01月06日 | 阅读数:5158
下面是filebeat-7.5.1/module/nginx/access/ingest/default.json的配置
{
"description": "Pipeline for parsing Nginx access logs. Requires the geoip and user_agent plugins.",
"processors": [
{
"grok": {
"field": "message",
"patterns": [
"\"\"?%{IP_LIST:nginx.access.remote_ip_list}\"\"%{NUMBER:nginx.access.request_time}\"\"%{DATA:nginx.access.upstream_response_time}\"\"%{DATA:nginx.access.user_name}\"\"\\[%{HTTPDATE:nginx.access.time}\\]\"\"%{DATA:nginx.access.upstream_addr}\"\"%{GREEDYDATA:nginx.access.info}\"\"%{NUMBER:nginx.access.response_code}\"\"%{NUMBER:nginx.access.body_sent.bytes}\"\"%{DATA:nginx.access.request_body}\"\"%{DATA:nginx.access.referrer}\"\"%{DATA:nginx.access.agent}\"\"%{DATA:nginx.access.xff}\""
],
"pattern_definitions": {
"IP_LIST": "%{IP}(\"?,?\\s*%{IP})*"
},
"ignore_missing": true
}
},
下面是field.yml添加的配置
- name: xff
type: group
description: >
http_x_forwarded_for.
- name: request_time
type: group
description: >
request_time 请求时间.
- name: upstream_response_time
type: group
description: >
upstream_response_time 后端响应时间.
- name: upstream_addr
type: group
description: >
upstream_addr 后端地址.
- name: request_body
type: group
description: >
request_body 请求主体.
{
"description": "Pipeline for parsing Nginx access logs. Requires the geoip and user_agent plugins.",
"processors": [
{
"grok": {
"field": "message",
"patterns": [
"\"\"?%{IP_LIST:nginx.access.remote_ip_list}\"\"%{NUMBER:nginx.access.request_time}\"\"%{DATA:nginx.access.upstream_response_time}\"\"%{DATA:nginx.access.user_name}\"\"\\[%{HTTPDATE:nginx.access.time}\\]\"\"%{DATA:nginx.access.upstream_addr}\"\"%{GREEDYDATA:nginx.access.info}\"\"%{NUMBER:nginx.access.response_code}\"\"%{NUMBER:nginx.access.body_sent.bytes}\"\"%{DATA:nginx.access.request_body}\"\"%{DATA:nginx.access.referrer}\"\"%{DATA:nginx.access.agent}\"\"%{DATA:nginx.access.xff}\""
],
"pattern_definitions": {
"IP_LIST": "%{IP}(\"?,?\\s*%{IP})*"
},
"ignore_missing": true
}
},
下面是field.yml添加的配置
- name: xff
type: group
description: >
http_x_forwarded_for.
- name: request_time
type: group
description: >
request_time 请求时间.
- name: upstream_response_time
type: group
description: >
upstream_response_time 后端响应时间.
- name: upstream_addr
type: group
description: >
upstream_addr 后端地址.
- name: request_body
type: group
description: >
request_body 请求主体.
1 个回复
liuxing6
赞同来自:
本来不就是number类型吗?