Output set by field

Elastic Stack Logstash
1

Hi Guys,

set logstash output influxdb, as title can out by field. output part like

output {
  influxdb_v2 {
    host => "10.200.101.18"
    port => "8086"
    org =>  "icep"
    token => "SIRq-QX3d7ddOI33Z9XfmZETHHGAFjH_033Dgfly6iiKIkQqMqS4lfEqdnbNpB5uydV_O2z4F-s5Mo8szJWfeA=="
    measurement => "%{measurement}"
    send_as_tags => ["[host][name]"]
    bucket => "test"
    exclude_fields => ["original"]
    use_event_fields_for_data_points => false
    data_points => {
      "car_number" => "%{car_number}" "location" => "%{location}" "status" => "%{status}"
    }
  }
}

output {
  stdout { }
}

As different log, need change measurement and data_points. In filter part, I add field add_field => { "measurement" => "parking-car-location" } to solve measurement, but data_points can not know how to solve, is there any idea? thanks

2

Try with commas

data_points => { "car_number" => "%{car_number}", "location" => "%{location}", "status" => "%{status}" }
3

Hi Rios

thanks, but that is not for my question.
my data_points format is right, can output metric. just different output content by logs. maybe this time is data_points => { "A" => "%{A}" "B" => "%{B}" "C" => "%{C}" } and next time is data_points => { "D" => "%{D}" "E" => "%{E}"}

4

In that case, you should use mutate and format dynamic array [@metadata][data_point] or use Ruby code. At the end will be:
data_points => { %{[@metadata][data_point] }

5

Hi Rios

can you show a example of dynamic array [@metadata][data_point]? thanks

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.