input{
file{
path => ["/tmp/data/t_url.csv"]
start_position =>"beginning"
}
}
filter{
csv{
separator => "|"
columns => ["rid","dir","username","sip","sport","dip","dport","bytes","starttime","action","url","descid","domain","type","subtype","words","line","platform","browser","grpids","referer","termtype"]
}
date {
match => ["starttime", "yyyy-MM-dd HH:mm:ss"]
target => "@timestamp"
}
}
output{
elasticsearch{
index => "webdata"
document_id => "%{rid}"
document_type => "url"
hosts => ["192.168.1.181:9200"]
}
}
这个是导入的模板,原来没有配置index的值,但是 elasticsearch 自动匹配了字段里的index值为默认的index值
经过测试发现可以在 output中添加
document_type => "url"
设置对应的type类型