不工作 logstash 多个 kafka 主题

Question

logstash 版本是 logstash-7.16.3

这是配置文件

input {
  kafka {
    bootstrap_servers => "abc-private-vip:9092"
    topics => ["label-result","text-result"]
    group_id => "result-group"
    consumer_threads => 2
    decorate_events => true
  }
}

output {
  if [@metadata][kafka][topic] == "label-result" {
    elasticsearch {
      hosts => ["abc-private-vip:9200"]
      index => "label-result-%{+YYYYMMdd}"
    }
  }

  if [@metadata][kafka][topic] == "text-result" {
    elasticsearch {
      hosts => ["tcore-private-vip:9200"]
      index => "text-result-%{+YYYYMMdd}"
    }
  }
}

如果删除了“if [@metadata][kafka][topic] == "text-result" {...}"，效果很好。

怎么了？ 很简单..

Answer 1

所以我修好了

input {
  kafka {
    bootstrap_servers => "tcore-private-vip:9092"
    topics => ["label-result","text-result"]
    group_id => "result-group"
    consumer_threads => 3
    decorate_events => "basic"
  }
}

filter {
  mutate {
    add_field => {
      "kafka-topic" => "%{[@metadata][kafka][topic]}"
    }
  }
}

output {
  elasticsearch {
    hosts => ["tcore-private-vip:9200"]
    index => "%{kafka-topic}-%{+YYYYMMdd}"
  }
}


"@timestamp" => 2022-03-14T08:38:45.250Z,
        "message" => "",
       "@version" => "1",
    "kafka-topic" => "label-result"

元数据存在但未推送到 elasticsearch