mad1230

请问有没有类似logstash的metadata的功能

5

可以使用metadata做判断依据，写入的时候metadata是丢弃的，翻了一遍没看到

求指导一下，想提取 [ ] 里面的内容， 这种数据怎么用grok分割，参考了logstash的写法，没效果

3

"[2020-07-17T09:21:22,629][INFO ][index.search.slowlog.query] [xxx] [xxx][4] took[753.7ms], took_millis[753], total_hits[1600383], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[990], source[{"size":500,"query":{"bool":{"must":[{"match_all":{"boost":1.0}},{"bool":{"should":[{"match_phrase":{"check_type":{"query":"4","slop":0,"zero_terms_query":"NONE","boost":1.0}}},{"match_phrase":{"check_type":{"query":"6","slop":0,"zero_terms_query":"NONE","boost":1.0}}}],"adjust_pure_negative":true,"minimum_should_match":"1","boost":1.0}},{"range":{"@timestamp":{"from":null,"to":null,"include_lower":true,"include_upper":true,"boost":1.0}}}],"adjust_pure_negative":true,"boost":1.0}},"version":true,"_source":{"includes":[],"excludes":[]},"stored_fields":"*","docvalue_fields":["@timestamp","create_time"],"script_fields":{},"sort":[{"@timestamp":{"order":"desc","unmapped_type":"boolean"}}],"aggregations":{"2":{"date_histogram":{"field":"@timestamp","time_zone":"Asia/Shanghai","interval":"1d","offset":0,"order":{"_key":"asc"},"keyed":false,"min_doc_count":1}}},"highlight":{"pre_tags":["@kibana-highlighted-field@"],"post_tags":["@/kibana-highlighted-field@"],"fragment_size":2147483647,"fields":{"*":{}}}}], "