需求场景:需要base64解码filebeat上传的某个字段,然后es方便做聚合
filter {
grok {
match => { "message" => "%{DATA:mark}&%{DATA:time}&%{WORD:app}&%{DATA:version}&%{DATA:deviceid}&%{DATA:channel}&%{DATA:uid}&%{INT:types}&%{DATA:position}&%{DATA:environment}&%{DATA:operator}&%{DATA:sysinfo}&%{GREEDYDATA:msg}"
}
remove_field => ['type','_id','input_type','tags','message','beat','source','offset']
}
if [types] in ['1','2','3','4','5'] {
ruby {
init => "require 'base64'"
code => "event['b64_decoded'] = Base64.decode64(event['msg']) if event.include?('msg')" #这里解码出刚刚截取出来的msg字段
}
json {
source => "b64_decoded" #因为b64_decoded解码出来json,需要继续进行解析
remove_field => ['b64_decoded']
}
}
}