efk/pipelines/monitor-io.json
2021-08-29 00:02:22 +08:00

77 lines
1.8 KiB
JSON

curl -H "Content-Type: application/json" -X PUT http://127.0.0.1:9200/_ingest/pipeline/monitor-io -d '
{
"description": "monitor-io",
"processors": [
{
"grok": {
"field": "message",
"patterns": [
"^%{MONITOR_TIME:monitor.time} %{DATA:monitor.io.dev} %{NUMBER:monitor.io.tps} %{NUMBER:monitor.io.rd} %{NUMBER:monitor.io.wr} %{NUMBER:monitor.io.wait} %{NUMBER:monitor.io.util}"
],
"pattern_definitions" : {
"MONITOR_TIME" : "^20[0-9][0-9]-[0-9][0-9]-[0-9][0-9] [0-9][0-9]:[0-9][0-9]:[0-9][0-9]"
},
"ignore_missing" : true,
"ignore_failure" : true
}
},
{
"rename" : {
"field" : "@timestamp",
"target_field" : "read_timestamp"
}
},
{
"date" : {
"formats" : [
"YYYY-MM-dd H:m:s"
],
"timezone" : "Asia/Shanghai",
"field" : "monitor.time",
"target_field" : "@timestamp",
"ignore_failure" : true
}
},
{
"convert": {
"field": "monitor.io.tps",
"type": "float"
}
},
{
"convert": {
"field": "monitor.io.rd",
"type": "float"
}
},
{
"convert": {
"field": "monitor.io.wr",
"type": "float"
}
},
{
"convert": {
"field": "monitor.io.wait",
"type": "float"
}
},
{
"convert": {
"field": "monitor.io.util",
"type": "float"
}
},
{
"remove": {
"field": "monitor.time"
}
},
{
"remove": {
"field": "message"
}
}
]
}'