Logstash Mutate转换 filter plugin

2019-06-10 0 By admin

The mutate filter allows you to perform general mutations on fields. You can rename, remove, replace, and modify fields in your events.
转换过滤器允许您在字段上执行一般转换。可以重命名、删除、替换和修改事件中的字段。

一、convert 类型转换

Value type is hash
There is no default value for this setting.
转换字段类型
Convert a field’s value to a different type, like turning a string to an integer. If the field value is an array, all members will be converted. If the field is a hash no action will be taken.

二、copy 字段复制

Value type is hash
Copy an existing field to another field. Existing target field will be overriden.
复制一个已存在的字段到另一个字段中。如果目标字段已存在,则覆盖。

三、gsub 正则替换

Value type is array
Match a regular expression against a field value and replace all matches with a replacement string. Only fields that are strings or arrays of strings are supported. For other kinds of fields no action will be taken.
This configuration takes an array consisting of 3 elements per field/substitution.
对字段匹配一个正则表达式,并替换其匹配内容。

四、join 字段拼接

Value type is hash
Join an array with a separator character. Does nothing on non-array fields.
使用特定字符,拼接数组类型的字段。

五、lowercase 转为小写

Value type is array
Convert a string to its lowercase equivalent.
转换为小写

六、merge 字段合并

Value type is hash
Merge two fields of arrays or hashes. String fields will be automatically be converted into an array。
合并两个数组或哈希字段。字符串字段将自动转换为数组。

七、coerce 设置默认值

Value type is hash
Set the default value of a field that exists but is null。
对已经存在,值为null的字段设置默认值。

八、rename 重命名

Value type is hash
Rename one or more fields.

九、replace 替换

Value type is hash
Replace the value of a field with a new value. The new value can include %{foo} strings to help you build a new value from other parts of the event.
字段内容替换。

十、split 字符串拆分

Value type is hash
Split a field to an array using a separator character. Only works on string fields.
使用分隔符将字段拆分为数组。仅适用于字符串字段。

十一、strip 删除空白

Value type is array
Strip whitespace from field. NOTE: this only works on leading and trailing whitespace.
从字段中删除空白。注意:这只适用于前导空格和尾随空格。

十二、update 更新字段

Value type is hash
Update an existing field with a new value. If the field does not exist, then no action will be taken.
用新值更新现有字段。如果字段不存在,则不会采取任何操作。

十三、uppercase 转为大写

Value type is array
Convert a string to its uppercase equivalent.
转换为大写

十四、capitalize 转为大写等效

Value type is array
Convert a string to its capitalized equivalent.
将字符串转换为其大写的等效字符串。