Logstash Mutate转换 filter plugin

2019-06-10 0 By admin

The mutate filter allows you to perform general mutations on fields. You can rename, remove, replace, and modify fields in your events.

一、convert 类型转换

Value type is hash
There is no default value for this setting.
Convert a field’s value to a different type, like turning a string to an integer. If the field value is an array, all members will be converted. If the field is a hash no action will be taken.

二、copy 字段复制

Value type is hash
Copy an existing field to another field. Existing target field will be overriden.

三、gsub 正则替换

Value type is array
Match a regular expression against a field value and replace all matches with a replacement string. Only fields that are strings or arrays of strings are supported. For other kinds of fields no action will be taken.
This configuration takes an array consisting of 3 elements per field/substitution.

四、join 字段拼接

Value type is hash
Join an array with a separator character. Does nothing on non-array fields.

五、lowercase 转为小写

Value type is array
Convert a string to its lowercase equivalent.

六、merge 字段合并

Value type is hash
Merge two fields of arrays or hashes. String fields will be automatically be converted into an array。

七、coerce 设置默认值

Value type is hash
Set the default value of a field that exists but is null。

八、rename 重命名

Value type is hash
Rename one or more fields.

九、replace 替换

Value type is hash
Replace the value of a field with a new value. The new value can include %{foo} strings to help you build a new value from other parts of the event.

十、split 字符串拆分

Value type is hash
Split a field to an array using a separator character. Only works on string fields.

十一、strip 删除空白

Value type is array
Strip whitespace from field. NOTE: this only works on leading and trailing whitespace.

十二、update 更新字段

Value type is hash
Update an existing field with a new value. If the field does not exist, then no action will be taken.

十三、uppercase 转为大写

Value type is array
Convert a string to its uppercase equivalent.

十四、capitalize 转为大写等效

Value type is array
Convert a string to its capitalized equivalent.