Logstash学习11_Logstash处理时区、类型转换、删除字段的案例配置

#输入
input {
 file {
        path => ["文件路径"]
#自定义类型
        type => "自定义"
       start_position => "beginning"
    }
}

#过滤器
filter{
#去除换行符
mutate{
gsub => [ "message", "\r", "" ]   
}

#逗号分割
mutate {  
  split => ["message",","]     
}

#分割后，字段命名与赋值
mutate{
                add_field =>   {
                                        "id" => "%{[message][0]}"
                                        "mydate" => "%{[message][1]}"
                                        "user" => "%{[message][2]}"
                                        "pc" => "%{[message][3]}"
                                        "to_user" => "%{[message][4]}"
"cc" => "%{[message][5]}"
"bcc" => "%{[message][6]}"