1

我是 ELK 堆栈的新手，可能会尝试设置一个非常复杂的配置以开始... :-)

我在 Windows 7 笔记本电脑上运行整个堆栈。我正在导入一个运行良好的 CSV，但我无法得到不分析的字符串字段，这在 kibana 可视化中给了我损坏的文本。

最后一次尝试是使用模板。

模板和 conf 文件都位于 c:\logstash-1.5.0\bin 目录中。

这是配置文件：

input {  
  file {
      path => "C:\Users\jeroen\Documents\temp\CSV\ElasticSearch_Input_vc.csv"
      type => "core2"
      start_position => "beginning"      }
}

filter {  
csv {
    columns => ["snapshot_date_time","Country","Tower","Service","Division","USD Group","Ref Nr","Processtype","Importance","Priority","Severity","Status and Reason","Category","Is_Valid_Category","Summary","Open Date Time","Closed Date Time","Opened By","Last Modified","Resolve Completed Date Time","Hrs_Assigned_To_Completed","First Assign Date Time","Hrs_New_To_Assign","Customer Organization","Requested By","Assignee","Active Flag","In Out SLA Resolution 1"]

    separator => ";"
}
date
{ match => [ "snapshot_date_time", "yyyy-MM-dd HH:mm:ss" ] }
mutate {
convert => { "Hrs_Assigned_To_Completed" => "float" }
convert => { "Hrs_New_To_Assign" => "float" }
  }
}
output {  
elasticsearch {
    action => "index"
    host => "localhost"
    index => "qdb-%{+YYYY.MM.dd}"
    workers => 1
    template => "template.json"
}
#stdout {
   #codec => rubydebug
#}
}

这是模板（老实说，我只是从另一个主题复制并更改了“模板名称”）我怀疑如何处理第 7 行，因为这可能特定于发起者使用的数据......

#template.json:
{
"template": "qdb-%{+YYYY.MM.dd}",
"settings" : {
    "number_of_shards" : 1,
    "number_of_replicas" : 0,
    "index" : {"query" : { "default_field" : "userid" } 
    }
},
"mappings": {
    "_default_": { 
        "_all": { "enabled": false },
        "_source": { "compress": true },
        "dynamic_templates": [
            {
                "string_template" : { 
                    "match" : "*",
                    "mapping": { "type": "string", "index": "not_analyzed" },
                    "match_mapping_type" : "string"
                 } 
             }
         ],
         "properties" : {
            "date" : { "type" : "date", "format": "yyyy-MM-dd HH:mm:ss"},
            "device" : { "type" : "string", "fields": {"raw": {"type":  "string","index": 
"not_analyzed"}}},
            "distance" : { "type" : "integer"}
    }
}
}

任何帮助/提示/提示表示赞赏！

4

2 回答 2

0

您需要在通过 logstash 导入数据后在第一个 ElasticSearch 中进行映射，然后您将在 Kibana 中看到未分析的数据

http://host:9200/yourindex/_mapping/yourtype

{
 "your type": {
 "properties": {
  "user" : {
    "type" : "string",
    "index": "not_analyzed",
  "data" : {
    "type" : "string",
    "index": "not_analyzed"
  }
    }
于 2015-07-24T11:58:13.310 回答
0

您可以使用变量“.raw”

例如，在我的配置中，我将 sourceip 设置为变量。

在我的可视化中，我可以选择使用 sourcip.raw，这将是变量的“not_analyzed”版本。

检查是否存在。

于 2016-04-21T15:55:36.630 回答