# 原始数据 734742416494845952,Android,"In trade, military and EVERYTHING else, it will be AMERICA FIRST! This will quickly lead to our ultimate goal: MAKE AMERICA GREAT AGAIN!",2016-05-23T13:46:57Z # 配置文件 filter { grok { patterns_dir => ["/root/custom-patterns.txt"] match => { "message" => "%{ID:id},%{DEVICE:device},%{MESSAGE_BODY:message},%{TIMESTAMP_ISO8601:timestamp}" } } } # 结果1 没有overwrite选项 "message": [ "734742416494845952,Android,"In trade, military and EVERYTHING else, it will be AMERICA FIRST! This will quickly lead to our ultimate goal: MAKE AMERICA GREAT AGAIN!",2016-05-23T13:46:57Z" , ""In trade, military and EVERYTHING else, it will be AMERICA FIRST! This will quickly lead to our ultimate goal: MAKE AMERICA GREAT AGAIN!"" ], "host": "localhost", "@timestamp": "2018-10-21T01:09:04.089Z", "device": "Android", "id": "734742416494845952", "timestamp": "2016-05-23T13:46:57Z", "path": "/root/trump-test.csv", "@version": "1"
# 结果2 设置overwrite选项 overwrite => ["message"] "message": "In trade, military and EVERYTHING else, it will be AMERICA FIRST! This will quickly lead to our ultimate goal: MAKE AMERICA GREAT AGAIN!", "host": "localhost", "@timestamp": "2018-10-21T01:09:04.089Z", "device": "Android", "id": "734742416494845952", "timestamp": "2016-05-23T13:46:57Z", "path": "/root/trump-test.csv", "@version": "1"
# 结果如下 "host": "localhost", "timestamp": "2016-05-23T13:46:57Z", "id": "734742416494845952", "tags": [ "test_734742416494845952" ], "@version": "1", "@timestamp": "2018-10-21T01:47:31.552Z", "message": "In trade, military and EVERYTHING else, it will be AMERICA FIRST! This will quickly lead to our ultimate goal: MAKE AMERICA GREAT AGAIN!", "path": "/root/trump-test.csv", "test_2016-05-23T13:46:57Z": "test"