2

我正在使用 Telegraf，并且我有多个 input.http 插件返回相同的字段名称并希望区分它们。

我为不同的搜索条件调用 ElasticSearch，返回的 JSON 结构始终相同，因此虽然我可以在 input.http 级别（name_override 或 name_suffix）定义度量，但我想更改始终为“doc_count”的字段值”。

示例输出（无论查询参数如何，结构都相同）：

{
    "took": 487,
    "timed_out": false,
    "_shards": {
        "total": 707,
        "successful": 707,
        "skipped": 610,
        "failed": 0
    },
    "hits": {
        "total": 14,
        "max_score": 0.0,
        "hits": []
    },
    "aggregations": {
        "3": {
            "doc_count_error_upper_bound": 0,
            "sum_other_doc_count": 0,
            "buckets": [
                {
                    "key": "logging-fluentd-jkq66",
                    "doc_count": 8
                },
                {
                    "key": "logging-fluentd-4vz58",
                    "doc_count": 4
                },
                {
                    "key": "logging-fluentd-4bh8j",
                    "doc_count": 2
                }
            ]
        }
    }
}

我玩过 processes.rename ，我可以让它工作（包括基于测量名称的过滤），但这仅适用于一个测量。它忽略了多个 porcesses.rename 定义。

以下定义仅尊重第一部分。

[[processors.rename]]
  namepass = "_http_elasticsearch_logs_dropping"
  [[processors.rename.replace]]
    measurement = "_http_elasticsearch_logs_dropping"
    dest = "_http_elastic"

  [[processors.rename.replace]]
    field = "doc_count"
    dest = "buffer_flush_or_queue_size_errors"

[[processors.rename]]
  namepass = "_http_elasticsearch_microservice_logs"
  [[processors.rename.replace]]
    measurement = "_http_elasticsearch_microservice_logs"
    dest = "_http_elastic"

  [[processors.rename.replace]]
    field = "doc_count"
    dest = "log_count"

我确信有一种方法可以实现我正在尝试做的事情，但还没有偶然发现它。

4

1 回答 1

0

好吧，我的错。processor.rename 可以有多个实例，我的问题是 namepass 参数应该是一个数组。基于上述场景的工作配置：

[[processors.rename]]
  namepass = ["_http_elasticsearch_logs_dropping"]
  [[processors.rename.replace]]
    measurement = "_http_elasticsearch_logs_dropping"
    dest = "_http_elastic"

  [[processors.rename.replace]]
    field = "doc_count"
    dest = "buffer_flush_or_queue_size_errors"

[[processors.rename]]
  namepass = ["_http_elasticsearch_microservice_logs"]
  [[processors.rename.replace]]
    measurement = "_http_elasticsearch_microservice_logs"
    dest = "_http_elastic"

  [[processors.rename.replace]]
    field = "doc_count"
    dest = "log_count"
于 2019-09-10T12:01:13.983 回答