curl -H "Content-Type: application/json" -X PUT http://127.0.0.1:9200/_ingest/pipeline/monitor-io -d ' { "description": "monitor-io", "processors": [ { "grok": { "field": "message", "patterns": [ "^%{MONITOR_TIME:monitor.time} %{DATA:monitor.io.dev} %{NUMBER:monitor.io.tps} %{NUMBER:monitor.io.rd} %{NUMBER:monitor.io.wr} %{NUMBER:monitor.io.wait} %{NUMBER:monitor.io.util}" ], "pattern_definitions" : { "MONITOR_TIME" : "^20[0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9]" }, "ignore_missing" : true, "ignore_failure" : true } }, { "rename" : { "field" : "@timestamp", "target_field" : "read_timestamp" } }, { "date" : { "formats" : [ "YYYY-MM-dd H:m:s" ], "timezone" : "Asia/Shanghai", "field" : "monitor.time", "target_field" : "@timestamp", "ignore_failure" : true } }, { "convert": { "field": "monitor.io.tps", "type": "float" } }, { "convert": { "field": "monitor.io.rd", "type": "float" } }, { "convert": { "field": "monitor.io.wr", "type": "float" } }, { "convert": { "field": "monitor.io.wait", "type": "float" } }, { "convert": { "field": "monitor.io.util", "type": "float" } }, { "remove": { "field": "monitor.time" } }, { "remove": { "field": "message" } } ] }'