将字段添加到Logstash Twitter输入和Elasticsearch输出 [英] Add fields to Logstash Twitter input and Elasticsearch output

问题描述

我正在使用logstash将twitter流保存到弹性搜索。在保存之前，我想要

I am using logstash to save the twitter stream to elasticsearch. Before saving, I want to

1. 添加一个新的字段，指示推文是RT还是有机


2. 将tweet id用作elasticsearch的文档ID

但是我也无法做到！ Logstash配置文件：

But I've been unable to do either! Logstash config file:

input {
twitter {
    oauth_token => ""
    oauth_token_secret => ""
    consumer_key => ""
    consumer_secret => ""
    full_tweet => true
    keywords => ["test"]
}
}

filter {
ruby {
    code => "
        if !event['retweeted_status'].nil?
            event['tweet_type'] = 'Retweet'
        elsif !event['in_reply_to_screen_name'].nil?
            event['tweet_type'] = 'Reply'
        else
            event['tweet_type'] = 'Organic'
        end
    "
}
}

output {
elasticsearch {
    document_id => [id]
    index_type => "twitter"
    protocol => "http"
    bind_host => "127.0.0.1"
}
}

我做错了什么？

推荐答案

你不需要去ruby来测试字段。尝试：

You don't need to drop to ruby to test fields. Try:

if [retweeted_status] {
    mutate {
       add_field => { "tweet_type", "Retweet" }
    }
}

：这是伪代码;我可能会有{s和=>错误）。

(NOTE: that's pseudo-code; I may have the the {s and => wrong).

关于使用文档ID，请尝试：

As for using the document id, try:

document_id => "%{id}"

这篇关于将字段添加到Logstash Twitter输入和Elasticsearch输出的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！