logstash:突变{gsub ...}不起作用 [英] logstash : Mutate { gsub ... } not working

问题描述

    mutate {
        add_field => {"eee" => "2016 uaie"}
        gsub => [
            "eee", "2016", "2015"
        ]
   }

这确实会创建一个字段"eee"，但是gsub将不对其进行更新.为什么?

This will indeed create a field "eee", but gsub will not update it. Why?

推荐答案

add_field在基础过滤器成功运行时运行.在您的情况下，先运行mutate {}，然后再运行add_field.

add_field runs when the underlying filter succeeds. In your case, the mutate{} is being run and then the add_field is run.

要在添加字段后使用mutate {}，请使用两个mutate块:

To have the mutate{} after the field is added, use two mutate blocks:

mutate {
    add_field => {"eee" => "2016 uaie"}
}

mutate {
    gsub => [
        "eee", "2016", "2015"
    ]
}

这篇关于logstash:突变{gsub ...}不起作用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！