Logstash系列：kv拦截器的使用

原始数据

ip=1.2.3.4 error=REFUSED

 

kv

filter {
      kv { }
    }

结果 

• ip: 1.2.3.4
• error: REFUSED

 

demo

source #处理not_the_message字段

allow_duplicate_values #删除重复字段

exclude_keys  #排除字段

trim_key、trim_value  #删除key、value中的字符 

filter {
  kv {
     source => "not_the_message"

  allow_duplicate_values => false

  exclude_keys => [ "from", "to" ]

  trim_key => "<>\[\],"

  trim_value => "<>\[\],"

  }
}