Mutate filter plugin參考: https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html

在線匹配:
http://grokdebug.herokuapp.com/

grok github正則:
https://github.com/kkos/oniguruma/blob/master/doc/RE

logstash grok目錄:
/usr/local/logstash/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-4.1.2/patterns

主要研究下這個插件的這些功能

增加字段

增加字段

input { stdin { codec => "json" } }

filter {
    mutate {
        add_field => { "status_true" => "1" }
    }
}

output {
    stdout { codec => rubydebug }
}

刪除字段

input { stdin { codec => "json" } }

filter {
    mutate {
        add_field => { "status_true" => "1" }
        remove_field => [isp]
    }
}

output {
    stdout { codec => rubydebug }
}
 

重命名字段名

input { stdin { codec => "json" } }

filter {
    mutate {
        rename => { "isp" => "province_isp" }
        remove_field => [isp]
    }
}

output {
    stdout { codec => rubydebug }
}

修改字段的值

input { stdin { codec => "json" } }

filter {
    mutate {
        replace => { "isp" => "阿裏飛飛" }
    }
}

output {
    stdout { codec => rubydebug }
}
 

轉換字段的值的類型

input { stdin { codec => "json" } }

filter {
    mutate {
        convert => { "success" => "string" }
    }
}

output {
    stdout { codec => rubydebug }
}

mutate {  
    convert => { "dest_Port" => "integer" }  
    convert => { "source_Port" => "integer" }
}  

{"mobile" : "15812345606", "province": "上海", "isp": "中國移動","time" : "2017-12-06T09:30:51.244Z", "success" : false}

[elk]Mutate filter plugin增刪改查字段