1

我使用journalbeat将journald事件发送到logstash（然后最终发送到elasticsearch）。我只对更高优先级的消息感兴趣。

在我journalbeat.yml文件的最顶部，我有

processors:
 - drop_event:
     when:
        range:
          syslog.priority.gte: 5

我的意图是运行一个处理器（在所有事件上），它会丢弃syslog.priority字段大于或等于5（= 丢弃debug和info消息）的事件。

这显然不起作用，因为我看到诸如

{
  "_index": "journalbeat-7.1.0-2019.05.28-000001",
  "_type": "_doc",
  "_id": "mlHv_moBGanrPHbULpIO",
  "_version": 1,
  "_score": null,
  "_source": {
    "@timestamp": "2019-05-28T14:54:07.866Z",
    "systemd": {
      "slice": "system.slice",
      "unit": "docker.service",
      "transport": "stdout",
      "cgroup": "/system.slice/docker.service",
      "invocation_id": "6b251fbc93814b26b857e33f79f261d2"
    },
    "ecs": {
      "version": "1.0.0"
    },
    "agent": {
      "ephemeral_id": "468fbf6d-8a90-47d2-8aff-a65d77c316c2",
      "hostname": "srv",
      "id": "c0526522-ca71-4a2a-a0e5-aa33f1e7c76e",
      "version": "7.1.0",
      "type": "journalbeat"
    },
    "message": "time=\"2019-05-28T16:54:07.866182040+02:00\" level=info msg=\"NetworkDB stats srv(cc5972674014) - netID:gpnvf5y5wthv491ypvpzunbot leaving:false netPeers:1 entries:2 Queue qLen:0 netMsg/s:0\"",
    "journald": {
      "custom": {
        "stream_id": "2e5695063ac54814a73ca48966594789",
        "selinux_context": "unconfined\n"
      }
    },
    "event": {
      "created": "2019-05-28T14:54:07.907Z"
    },
    "host": {
      "architecture": "x86_64",
      "hostname": "srv",
      "id": "77c0caf0e493e9cd0f7c689856d9e916",
      "boot_id": "a51ba1fe7c884be685c53329db0f036b",
      "name": "srv",
      "os": {
        "codename": "bionic",
        "platform": "ubuntu",
        "version": "18.04.2 LTS (Bionic Beaver)",
        "family": "debian",
        "name": "Ubuntu",
        "kernel": "4.15.0-50-generic"
      },
      "containerized": false
    },
    "syslog": {
      "facility": 3,
      "priority": 6,
      "identifier": "dockerd"
    },
    "process": {
      "pid": 7607,
      "name": "dockerd",
      "uid": 0,
      "cmd": "/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock -H tcp://0.0.0.0:2375",
      "executable": "/usr/bin/dockerd-ce",
      "capabilites": "3fffffffff"
    }
  },
  "fields": {
    "@timestamp": [
      "2019-05-28T14:54:07.866Z"
    ],
    "event.created": [
      "2019-05-28T14:54:07.907Z"
    ]
  },
  "sort": [
    1559055247866
  ]
}

被发送到elasticsearch（然后我通过kibana看到）。请注意

    "syslog": {
      "facility": 3,
      "priority": 6,
      "identifier": "dockerd"
    },

syslog.priority: 6然后在 kibana 中解析到的部分。

处理器应该如何连接到“所有事件”？

4

0 回答 0