如何解析Kibana的自定义Metricbeat词典? [英] How can I parse custom Metricbeat dictionary for Kibana?
问题描述
我设置了logstash发送到Kibana,它使用两个自定义字段(集群和节点)标记每个日志文件:
I have logstash set up sending to Kibana, and it tags each log file with two custom fields -- Cluster and Node:
我想使用"fields"选项将相同的两个字段添加到Metricbeat配置中,但是当我这样做时,它作为Kibana中的字典出现:
I would like to add the same two fields to my Metricbeat configuration using the "fields" option, but when I do this it comes through as a dictionary in Kibana:
这是我正在使用的Metricbeat配置文件:
Here is the Metricbeat config file I'm using:
metricbeat.modules:
- module: system
metricsets:
# CPU stats
- cpu
# System Load stats
- load
# Per CPU core stats
#- core
# IO stats
#- diskio
# Per filesystem stats
- filesystem
# File system summary stats
- fsstat
# Memory stats
- memory
# Network stats
- network
# Per process stats
- process
# Sockets (linux only)
#- socket
enabled: true
period: 10s
processes: ['.*']
#Add Supervisor Cluster and Node ID
fields:
cluster: "Upswell ELK Testing Cluster"
node: "Nina's Macbook"
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["http://localhost:9200"]
我找不到任何有关如何格式化这些字段的文档;这是我应该在Logstash还是在Metricbeat配置中进行的调整?
I can't find any documentation about how to format these fields; is this an adjustment I should be making in Logstash or in the Metricbeat configuration?
推荐答案
来自: https://www.elastic.co/guide/zh-CN/beats/metricbeat/current/configuration-general.html
字段:默认情况下,您在此处指定的字段将被分组在输出文档中的子词典下.要将自定义字段存储为顶级字段,请将 fields_under_root 选项设置为 true .
fields : By default, the fields that you specify here will be grouped under a fields sub-dictionary in the output document. To store the custom fields as top-level fields, set the fields_under_root option to true.
这篇关于如何解析Kibana的自定义Metricbeat词典?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!