add_field
配置文件
input{
file{
add_field => {
"testfield"=>"testfield"}
path => ["/tmp/a.txt"]
type => "a-txt"
}
}
output{
if [type] == "a-txt"{
elasticsearch{
hosts => ["192.168.6.104:9200"]
index => "a-txt-%{+YYYY-MM-dd}"
}
stdout { codec => rubydebug }
}
}
测试:
echo 4 >> a.txt
echo 5 >> a.txt
输出
{
"path" => "/tmp/a.txt",
"@timestamp" => 2017-09-17T02:40:20.327Z,
"@version" => "1",
"host" => "no104.p100.net",
"message" => "4",
"type" => "a-txt",
"testfield" => "testfield"
}
{
"path" => "/tmp/a.txt",