send csv to es with filebeat

*.csv

APPLICATIONID,LEVEL,ERROR

filebeat 

filebeat.inputs:
- paths:
- C:\logs\*csv
input_type: log
exclude_lines: ['^APPLICATIONID']
multiline.pattern: '^\d'
multiline.negate: true
multiline.match: after

output.elasticsearch:
hosts: ["clusterurl:8888"]
index: "csvindex"
pipeline: test_pipeline

es pipleline 

PUT _ingest/pipeline/test_pipeline
{
  "processors": [
    {
      "split": {
        "field": "message",
        "target_field": "test",
        "separator": ","
      }
    },
    {
      "script": {
        "lang": "painless",
        "source": "ctx.ApplicationId = ctx.test[0];ctx.Level = ctx.test[1];ctx.Error = ctx.test[2]"
      }
    },
    {
      "remove": {
        "field": ["test"]
      }
    }
  ]
}

  

猜你喜欢

转载自www.cnblogs.com/merseyalma/p/11976513.html
csv