logstash 提取 json 字段并覆盖索引

Question

我有以下 json：

[
{
    "key": "Key-1",
    "field1": "hello",
    "field2": "world"
},
{

    "key": "Key-2",
    "field1": "hello",
    "field2": "world"
}
]

以及以下logstash文件：

input {
  http_poller {
    # List of urls to hit
    # URLs can either have a simple format for a get request
    # Or use more complex HTTP features
    urls => {
      myurl => {
        method => "GET"
        url => "http://localhost:8080/helloworld"
      }
    }
    # Decode the results as JSON
    codec => "json"
    # Schedule task
    schedule => { cron => "* * * * * UTC" }
  }

}

output {
  #debugging output

  stdout {
    codec => rubydebug
  }

  # elasticsearch output

  elasticsearch{
   hosts => "localhost"
   index => "helloworld"
  }

}

问题是这个logstash创建了多个具有相同键的文档，我希望logstash替换索引中的现有文档。反正我能做到吗？ 提前致谢。

Answer 1

您应该定义文档的 id 是什么，以便您可以根据密钥更新现有的。

elasticsearch {
  document_id => "%{key}"
  hosts => "localhost"
  index => "helloworld"
}

有关详细信息，请参阅文档 here。