ELK 5.4.3 替换更新——上线计划

filter {

    if [type] == "jx-app-nginx-tp" {
        ruby {
            init => "@kname = ['remote_addr','time_local','host','url','status','body_bytes_sent','http_referer','http_user_agent','http_x_forwarded_for','upstream_addr','upstream_status','upstream_response_time','server_addr','request_time','waf_flag']"
     
        code => "
            new_event = LogStash::Event.new(Hash[@kname.zip(event.get('message').split(' | '))])
            new_event.remove('@timestamp')
            event.append(new_event)
        "
        }

    geoip {
      source => "remote_addr"
      target => "geoip"
      database => "/usr/local/logstash-5.4/conf/Geoip_data/GeoLite2-City.mmdb"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
    }

        mutate {
remove_field => "message"
            convert => [
                "[geoip][coordinates]", "float",
                "body_bytes_sent" , "integer",
                "upstream_response_time", "float"
            ]
        }

    }

}