重启filebeat后,nginx访问日志会写入到logstash中,但此时logstash写入elasticsearch会报错:failed to parse field [host] of type [text] in document with id 'E0lsjW4BTdp_eLcgfhbu' 看elasticsearch日志发现此时host为一个json对象,需要变为字符串才行 修改配置,添加过滤器,把host.name赋值为host vi config/logstash.conf filter { mutate { rename => { "[host][name]" => "host" } } }
重启filebeat后,nginx访问日志会写入到logstash中,但此时logstash写入elasticsearch会报错:failed to parse field [host] of type [text] in document with id 'E0lsjW4BTdp_eLcgfhbu'看elasticsearch日志发现此时host为一个json对象,需要变为字符串才行修改配置,添加过滤器,把host.name赋值为hostvi config/logstash.conffilter