logstash 字段类型转换后 需要刷新

[html]  view plain  copy

 

1. filter {  
2.     grok {  
3.         match => [  
4.              "message" , "\s*%{IPORHOST:clientip}\s+\-\s+\-\s+
   \s+\"%{WORD:verb}\s+(?<api>(\S+))\?.*\s+HTTP/%{NUMBER:httpversion}\"\s+%{NUMBER:http_status_code}\s+%{NUMBER:bytes}\s+(%{BASE16FLOAT:request_time})\s+%{IPORHOST:remoteip}",  
5.               "message" ,"\s*%{IPORHOST:clientip}\s+\-\s+\-\s+
   \s+\"%{WORD:verb}\s+(?<api>(\S+))\s+HTTP/%{NUMBER:httpversion}\"\s+%{NUMBER:http_status_code}\s+%{NUMBER:bytes}\s+(%{BASE16FLOAT:request_time})\s+%{IPORHOST:remoteip}",  
6.              "message" ,"\s*%{IPORHOST:clientip}\s+\-\s+\-\s+
   \s+\"%{WORD:verb}\s+(?<api>(\S+))\s+HTTP/%{NUMBER:httpversion}\"\s+%{NUMBER:http_status_code}\s+\-\s+(%{BASE16FLOAT:request_time})\s+%{IPORHOST:remoteip}"  
7.         ]  
8.     }     
9.         mutate {  
10.                         convert => [ "request_time", "float"]  
11.                        add_field =>["response_time","%{request_time}"]  
12.                         remove_field =>["request_time"]  
13.                           
14.                 }  
15.    date {  
16.         match => ["time", "dd/MMM/yyyy:HH:mm:ss Z"]  
17.     }  
18.        
19. }