[英]Logstash - Use of Memorize plugin
Trying to use the "memorize" plugin like so: 尝试使用“记忆”插件,如下所示:
if [message] =~ /matching event/ {
grok {
match => [ "message", "%{mymatch:datetime}" ]
}
memorize {
field => [datetime]
}
}
if [message] =~ /another event/ {
mutate {
add_field => {
datetime => "%{datetime}"
}
}
}
A field called datetime is being added, but it only contains the text "%{datetime}". 将添加一个名为datetime的字段,但该字段仅包含文本“%{datetime}”。 Clearly I'm using the plugin incorrectly.
显然,我使用的插件不正确。 Can anyone advise on how to reference the memorized value please?
有人可以建议如何参考存储的值吗?
Thanks. 谢谢。
The way that plugin works would be like this: 插件的工作方式如下:
if [message] =~ /matching event/ {
grok {
match => [ "message", "%{mymatch:datetime}" ]
}
}
# either save the datetime or add it based on last value
memorize {
field => 'datetime'
default => '00:00:00'
}
if [message] =~ /another event/ {
# datetime has already been added based on the above line
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.