logstash config as follow
input {
elasticsearch {
hosts => [ "10.10.10.100:9200" ]
index => "test2"
query => '{"query": {"filtered": { "query": {"term": { "_type": "test2" } },"filter" : {"range": {"lastupdatetime": {"gte": "2015-09-01 00:00:00","lt": "2015-10-01 00:00:00"}}}}}}'
size => 10000
scroll => "5m"
docinfo => true
}
}
filter {
mutate {
remove_field => ["@timestamp", "@version"] #过滤掉logstash 自己加上的字段
}
}
output {
elasticsearch {
hosts => [ "10.10.10.200:9200" ]
index => "test2"
document_type => "%{[@metadata][_type]}"
document_id => "%{[@metadata][_id]}"
}