如何在logstash中键入数据输入

Question

我正在尝试通过 logstash 向 elasticsearch 输入一个 csv 文件。

这是我的配置文件

input {
  file {
    codec => plain{
    charset => "ISO-8859-1"
    }
    path => ["PATH/*.csv"]
    sincedb_path => "PATH/.sincedb_path"
    start_position => "beginning"
  }
}
filter {

    if [message] =~ /^"ID","DATE"/ {
    drop { }
    }
  date {
    match => [ "DATE","yyyy-MM-dd HH:mm:ss" ]
    target => "DATE"
  }
    csv {
    columns => ["ID","DATE",...]
    separator => ","
    source => message
    remove_field => ["message","host","path","@version","@timestamp"]
  }
}

output {

     elasticsearch {
    embedded => false
    host => "localhost"
    cluster => "elasticsearch"
    node_name => "localhost"
    index => "index"
    index_type => "type"
  }
}

现在，elasticsearch 中生成的映射将 DATE 字段类型为字符串。我想输入日期字段。

在过滤元素中，我尝试将日期中的类型字段进行转换，但没有用。

我该如何解决？

此致，亚历山大

Answer 1

您的过滤器链设置顺序错误。 date{} 块需要在 csv {} 块之后。

如何在logstash中键入数据输入

How to type data input in logstash

elasticsearch

logstash