[log]logstash添加字段.geoip展示

add_field

配置文件

input{
    file{
        add_field => {
  "testfield"=>"testfield"}
        path => ["/tmp/a.txt"]
        type => "a-txt"
    }
}

output{
    if [type] == "a-txt"{
        elasticsearch{
            hosts => ["192.168.6.104:9200"]
            index => "a-txt-%{+YYYY-MM-dd}"
        }
        stdout { codec => rubydebug }
    }
}

测试:

echo 4 >> a.txt
echo 5 >> a.txt

输出

{
          "path" => "/tmp/a.txt",
    "@timestamp" => 2017-09-17T02:40:20.327Z,
      "@version" => "1",
          "host" => "no104.p100.net",
       "message" => "4",
          "type" => "a-txt",
     "testfield" => "testfield"
}
{
          "path" => "/tmp/a.txt",