logstash 5 ruby 过滤器

logstash 5 ruby filter

我最近将一个 elk-stack 集群从旧版本升级到 5.1,虽然一切看起来都很好,但我在 logstash 日志中经常出现异常,如下所示:

logstash.filters.ruby Ruby exception occurred: Direct event field    references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')). Please consult the  Logstash 5.0 breaking changes documentation for more details.

我的过滤器是这样的:

    filter {
    ruby {
        init => "require 'time'"
        code => "event.cancel if event['@timestamp'] < Time.now-(4*86400)"
    }
}

有什么建议吗?

异常包含答案:

Direct event field references (i.e. event['field']) have been disabled in favor of using event get and set methods (e.g. event.get('field')).

由此看来,event.get('@timestamp') 现在似乎优于事件 ['@timestamp']。