在 logstash 配置中配置弹性管道附件？

Question

我正在使用摄取附件来获取 base64 字段的数据。

PUT _ingest/pipeline/attachment
{
  "description" : "Extract attachment information",
  "processors" : [
    {
      "attachment" : {
        "field" : "data"
      }
    }
  ]
}



PUT my_index/my_type/my_id?pipeline=attachment
{ 
  "data": "e1xydGYxXGFuc2kNCkxvcmVtIGlwc3VtIGRvbG9yIHNpdCBhbWV0DQpccGFyIH0="
}

GET my_index/my_type/my_id

{
  "found": true,
  "_index": "my_index",
  "_type": "my_type",
  "_id": "my_id",
  "_version": 1,
  "_source": {
    "data":     "e1xydGYxXGFuc2kNCkxvcmVtIGlwc3VtIGRvbG9yIHNpdCBhbWV0DQpccGFyIH0=",
"attachment": {
  "content_type": "application/rtf",
  "language": "ro",
  "content": "Lorem ipsum dolor sit amet",
  "content_length": 28
   }
  }
}

如何使用 Logstash 配置文件做同样的事情？我没有看到任何定义管道附件的参考。

Answer 1

您只需在 elasticsearch 输出配置中指定 which pipeline to use，这样您的事件就会被正确的管道处理，如下所示：

output {
    elasticsearch {
        hosts => ["localhost:9200"]
        index => "my_index"
        document_type => "my_type"
        pipeline => "attachment"              <--- use this
    }
}

PS：请注意，这仅适用于 ES 5 和 Logstash 5。

在 logstash 配置中配置弹性管道附件？

Configure elastic pipeline attachment in logstash configuration?

elasticsearch

logstash

logstash-configuration