logstash - 动态字段名称

Question

我的 Logstash 配置中的动态字段名称有问题。 这是我的测试配置：

input {
generator {
    lines => [ "May 15 13:42:55 logstash puppet-agent[3551]: Finished catalog run in 43",
                "May 16 14:57:07 logstash puppet-agent[3551]: Starting Puppet client version" ]
    count => 7
}
}
filter {
   grok {
     match => [ "message", "%{SYSLOGBASE} %{WORD:log}.*" ]
   }

        if "Starting" in [log] {
        metrics {
          meter => [ "%{logsource}.%{log}" ]
          add_tag => [ "metric" ]
          add_field => { "server" => "%{logsource}" 
                        "bad" => "true" }
          clear_interval => 5
                }
       }
}
output {
        stdout { codec => rubydebug }
}

这是我的输出：（输出结束）

{
       "message" => "May 15 13:42:55 logstash puppet-agent[3551]: Finished catalog run in 43",
      "@version" => "1",
    "@timestamp" => "2016-06-07T07:37:50.138Z",
          "host" => "logstash.test.lan",
      "sequence" => 6,
     "timestamp" => "May 15 13:42:55",
     "logsource" => "test",
       "program" => "puppet-agent",
           "pid" => "3551",
           "log" => "Finished"
}
{
       "message" => "May 16 14:57:07 logstash puppet-agent[3551]: Starting Puppet client version",
      "@version" => "1",
    "@timestamp" => "2016-06-07T07:37:50.138Z",
          "host" => "logstash.test.lan",
      "sequence" => 6,
     "timestamp" => "May 16 14:57:07",
     "logsource" => "test",
       "program" => "puppet-agent",
           "pid" => "3551",
           "log" => "Starting"
}
{
      "@version" => "1",
    "@timestamp" => "2016-06-07T07:37:50.288Z",
       "message" => "Counting: 7",
      "logstash.Starting" => {
           "count" => 7,
         "rate_1m" => 0.0,
         "rate_5m" => 0.0,
        "rate_15m" => 0.0
    },
        "server" => "%{logsource}",
           "bad" => "true",
          "tags" => [
        [0] "metric"
    ]
}

为什么字段 server 没有 logstash 作为输入日志中的值？ %{logsource} 适用于 meter 选项，那么为什么不适用于 add_field 呢？ 谢谢帮忙。

Answer 1

当收到日志事件时，会从内容中提取 SYSLOGBASE 信息。这是定义 %{logsource} 值的地方。如果事件不是来自包含 SYSLOGBASE 信息的日志条目，则 logsource 将是未定义的。

当您收到启动消息时，会在范围内定义 logsource 并将其添加到您的消息中。

指标插件在每个时间间隔生成一条新消息。此消息是从头开始生成的，因此它没有 logsource 的值或通常从单个日志条目中获得的任何其他值。