Logstash输入文件名作为输出elasticsearch索引 [英] Logstash input filename as output elasticsearch index

问题描述

有没有办法让logstash读取文件的文件名作为输出到ElasticSearch的索引名?

Is there a way of having the filename of the file being read by logstash as the index name for the output into ElasticSearch?

我正在为logstash使用以下配置.

I am using the following config for logstash.

input{
    file{
        path => "/logstashInput/*"
    }
}
output{
    elasticsearch{
        index => "FromfileX"
    }
}

我希望能够放置文件e.g. log-from-20.10.2016.log并将其索引到索引log-from-20.10.2016中. logstash输入插件文件"会产生任何变量供过滤器或输出使用吗?

I would like to be able to put a file e.g. log-from-20.10.2016.log and have it indexed into the index log-from-20.10.2016. Does the logstash input plugin "file" produce any variables for use in the filter or output?

推荐答案

是的，您可以使用path字段，并grok将该文件名提取到index字段

Yes, you can use the path field for that and grok it to extract the filename into the index field

  input {
     file {
         path => "/logstashInput/*"
     }
  }
  filter {
     grok {
        match => ["path", "(?<index>log-from-\d{2}\.\d{2}\.\d{4})\.log$" ]
     }
  }
  output{
     elasticsearch {
        index => "%{index}"
     }
  }

这篇关于Logstash输入文件名作为输出elasticsearch索引的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！