在elk6.8.8中,logstash的配置如下:
input {
tcp {
port => 10004
codec => json
type => imas_dev_log
}
}
output{
if [fields][type] == "imas_dev_log" {
elasticsearch {
hosts => ["172.16.11.3x:9200","172.16.11.2x:9200","172.16.11.2x:9200"]
index => "imas_dev_log"
}
}
}
有的配置用的[type],这个会报错如下截图:
input {
tcp {
port => 10004
codec => json
type => imas_dev_log
}
}
output{
if [type] == "imas_dev_log" {
elasticsearch {
hosts => ["172.16.11.3x:9200","172.16.11.2x:9200","172.16.11.2x:9200"]
index => "imas_dev_log"
}
}
}
因为在ES6之后文档的type属性没有了,所以要加[fields][type],标识type是一个字段。所以大家在用的时候要考虑自己ES的版本