elk使用grok字段类型设置

1.仅支持int 和 float

Optionally you can add a data type conversion to your grok pattern. By default all semantics are saved as strings. If you wish to convert a semantic’s data type, for example change a string to an integer then suffix it with the target data type. For example %{NUMBER:num:int} which converts the num semantic from a string to an integer. Currently the only supported conversions are int and float.

 

2.支持'string,integer,float,boolean'

filter {  
  csv {
      separator => ","
      columns => ["Date","Open","High","Low","Close","Volume","Adj Close"]
  }
  mutate {convert => ["High", "float"]}
  mutate {convert => ["Open", "float"]}
  mutate {convert => ["Low", "float"]}
  mutate {convert => ["Close", "float"]}
  mutate {convert => ["Volume", "float"]}
}

 

3.将日志中的时间戳设置为默认的 @timestamp(首先抽取到strlogtime中，然后放入@timestamp)

 

if [type] == "hailianglog" {

  grok {

      patterns_dir => "/etc/logstash/patterns"

      match => {"message" => "%{YEARDATESTAMP:strlogtime}%{SPACE}%{JAVAFILEINFO:logpackage}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{JAVACLASS:package}%{SPACE}%{MESSAGE:msg}"}

  }

date { match => ["strlogtime", "yyyy-MM-dd HH:mm:ss.SSS"] target => "@timestamp" }

}

 注：YEARDATESTAMP %{YEAR}[/-]%{MONTHNUM}[/-]%{MONTHDAY}[- ]%{TIME}