Nsryjdtyk

I use the ELK + Filebeat , all version is 6.4.3 , the OS is windows 10

I add custom field in filebeat.yml , the key name is log_type , the value of log_type is nginx-access

The picture show part of filebeat.yml.

The content of logstash.conf is :

input {

    beats { 

       host => "0.0.0.0"

       port => "5544"

  } 

} 



filter {



mutate { 

  rename => { "[host][name]" => "host" } 

}   



if [fields][log_type] == "nginx-access" {

    grok {

                  match => { "message" => ["%{IPORHOST:[nginx][access][remote_ip]} - %{DATA:[nginx][access][user_name]} [%{HTTPDATE:[nginx][access][time]}] "%{WORD:[nginx][access][method]} %{DATA:[nginx][access][url]} HTTP/%{NUMBER:[nginx][access][http_version]}" %{NUMBER:[nginx][access][response_code]} %{NUMBER:[nginx][access][body_sent][bytes]} "%{DATA:[nginx][access][referrer]}" "%{DATA:[nginx][access][agent]}" "%{DATA:[nginx][access][x_forwarded_for]}" %{NUMBER:[nginx][access][request_time]}"] }

            }



mutate {

     copy => { "[nginx][access][request_time]" => "[nginx][access][requesttime]" }

  }



mutate {

      convert => {

      "[nginx][access][requesttime]" => "float"

    }

  }

}

}



output {

      stdout { 

       codec => rubydebug { metadata => true }

      }



      elasticsearch { 

        hosts => ["localhost:9200"] 

      } 

    }

When I use the command :

logstash.bat  -f  logstash.conf

The output is :

Question 1：

The field in the red box above is "requesttime" and "request_time" , what I want the field is nginx.access.requesttime and nginx.access.request_time，not requesttime and request_time 。 How should I modify logstash.conf to achieve my goal?

Question 2:

When I use the above logstash.conf , the field of the kibana management interface is only "request_time" field .

The picture show this :

If I want the "nginx.access.requesttime" field to also appear in the fields of the Kibana management interface, how should I modify the logstash.conf ?

Question 1:

I believe what you are looking for is

mutate {

   copy => { "[nginx][access][request_time]" => "nginx.access.requesttime" }

}

Question 2:

Whethere something is a keyword is determined by the template field mapping in Elasticsearch. Try the option above and see if the issue resolved.

This issue in elastic forum may help you.