first commit
This commit is contained in:
52
pipelines/monitor-conn.json
Normal file
52
pipelines/monitor-conn.json
Normal file
@@ -0,0 +1,52 @@
|
||||
curl -H "Content-Type: application/json" -X PUT http://127.0.0.1:9200/_ingest/pipeline/monitor-conn -d '
|
||||
{
|
||||
"description": "monitor-conn",
|
||||
"processors": [
|
||||
{
|
||||
"grok": {
|
||||
"field": "message",
|
||||
"patterns": [
|
||||
"^%{MONITOR_TIME:monitor.time} %{HOSTNAME:monitor.conn.server} %{NUMBER:monitor.conn.port} %{NUMBER:monitor.conn.count}"
|
||||
],
|
||||
"pattern_definitions" : {
|
||||
"MONITOR_TIME" : "^20[0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9]"
|
||||
},
|
||||
"ignore_missing" : true,
|
||||
"ignore_failure" : true
|
||||
}
|
||||
},
|
||||
{
|
||||
"rename" : {
|
||||
"field" : "@timestamp",
|
||||
"target_field" : "read_timestamp"
|
||||
}
|
||||
},
|
||||
{
|
||||
"date" : {
|
||||
"formats" : [
|
||||
"YYYY-MM-dd H:m:s"
|
||||
],
|
||||
"timezone" : "Asia/Shanghai",
|
||||
"field" : "monitor.time",
|
||||
"target_field" : "@timestamp",
|
||||
"ignore_failure" : true
|
||||
}
|
||||
},
|
||||
{
|
||||
"convert": {
|
||||
"field": "monitor.conn.count",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
{
|
||||
"remove": {
|
||||
"field": "monitor.time"
|
||||
}
|
||||
},
|
||||
{
|
||||
"remove": {
|
||||
"field": "message"
|
||||
}
|
||||
}
|
||||
]
|
||||
}'
|
||||
Reference in New Issue
Block a user