About the Logstash data output

Elastic Stack Logstash
1

I try to use metricbeat + logstash + influxdb for data collection,
Logstash conf:

influxdb {
  host => ["xxx.xxx.xxx.xxx"]
  db => "metricbeat"
  codec => json
  data_points => {
    "platform" => "%{platform}"
    "hostname" => "%{[beat][hostname]}"
    "system.core.id" => "%{[system][core][id]}"
    "system.cpu.user.pct" => "%{[system][cpu][user][pct]}"
  }

influxdb:

SELECT * FROM logstash ORDER BY time DESC LIMIT 10
name: logstash
time beat beat.hostname beats_input_raw_event environnement hostname ip_address platform system.core.id system.core.user.pct system.cpu.user.pct

1510806295000000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}
1510806294987000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}
1510806294838000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}
1510806294835000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}
1510806294833000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}
1510806294832000000 rh6.5 BT 0 %{[system][cpu][user][pct]}
1510806294829000000 rh6.5 BT %{[system][core][id]} %{[system][cpu][user][pct]}
1510806294812000000 rh6.5 BT %{[system][core][id]} 0.015

I hope:

1510806295000000000 rh6.5 BT
1510806294987000000 rh6.5 BT
1510806294838000000 rh6.5 BT
1510806294835000000 rh6.5 BT
1510806294833000000 rh6.5 BT
1510806294832000000 rh6.5 BT 0
1510806294829000000 rh6.5 BT
1510806294812000000 rh6.5 BT 0.015

What should I do?

2 
if [metricset][name] == "cpu" {
  influxdb {
    host => ["192.168.100.13"]
    db => "metricbeat"
    codec => json
    data_points => {
        "platform" => "%{platform}"
        "hostname" => "%{[beat][hostname]}"
        "system.cpu.user.pct" => "%{[system][cpu][user][pct]}"
    }
  }
} else if [metricset][name] == "memory" {
    influxdb {
      host => ["192.168.100.13"]
      db => "metricbeat"
      codec => json
      data_points => {
        "platform" => "%{platform}"
        "hostname" => "%{[beat][hostname]}"
        "system.memory.used.pct" => "%{[system][memory][used][pct]}"
        }
      }
    }

}
}

The above method to solve my problem, but good writing complicated, do not know to have a more simple way

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.