<div id="readability-page-1" class="page"><div id="post-body-6511765529749776728" itemprop="articleBody">

<div><pre><code>filter {&nbsp;mutate {&nbsp; remove_field =&gt; ["@timestamp", "@version", "path", "host"]&nbsp;}&nbsp;dissect {&nbsp; mapping =&gt; {"message" =&gt; '%{} "%{} %{uri} %{}" %{}'}&nbsp;}<a name="more"></a>if [uri] =~ '\?' {&nbsp; grok {&nbsp; &nbsp;match =&gt; {'uri' =&gt; '(?&lt;url&gt;[^?]+)\?(?&lt;param&gt;.*)'}&nbsp; }&nbsp;} else {&nbsp; mutate {&nbsp; &nbsp;copy =&gt; {'uri' =&gt; 'url'}&nbsp; }&nbsp;}}</code></pre></div>
<div><pre><code>{&nbsp; &nbsp; "message" =&gt; "1.2.3.4 - - [12/Oct/2024:02:42:00 +0900] \"GET /bbs/view.html HTTP/1.1\" 200 37727\r",&nbsp; &nbsp; &nbsp; &nbsp; "uri" =&gt; "/bbs/view.html",&nbsp; &nbsp; &nbsp; &nbsp; "url" =&gt; "/bbs/view.html"}{&nbsp; &nbsp; "message" =&gt; "192.168.56.1 - - [12/Oct/2024:02:42:00 +0900] \"GET /bbs/view.php?board_id=kor%5Fmedia&amp;gul_no=1106&amp;idx=17&amp;m=4&amp;upage=25&amp;tpage=&amp;PAGE=4 HTTP/1.1\" 200 37727\r",&nbsp; &nbsp; &nbsp; "param" =&gt; "board_id=kor%5Fmedia&amp;gul_no=1106&amp;idx=17&amp;m=4&amp;upage=25&amp;tpage=&amp;PAGE=4",&nbsp; &nbsp; &nbsp; &nbsp; "uri" =&gt; "/bbs/view.php?board_id=kor%5Fmedia&amp;gul_no=1106&amp;idx=17&amp;m=4&amp;upage=25&amp;tpage=&amp;PAGE=4",&nbsp; &nbsp; &nbsp; &nbsp; "url" =&gt; "/bbs/view.php"}</code></pre></div>

역시 데이터 조건에 따라 달라지는 beat processor.
<div><pre><code>processors:&nbsp; - include_fields:&nbsp; &nbsp; &nbsp; fields: "message"&nbsp; - dissect:&nbsp; &nbsp; &nbsp; tokenizer: '%{} "%{} %{uri} %{}" %{}'&nbsp; &nbsp; &nbsp; target_prefix: ""&nbsp; - if:&nbsp; &nbsp; &nbsp; contains.uri: "?"&nbsp; &nbsp; then:&nbsp; &nbsp; &nbsp; - dissect:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; field: "uri"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; tokenizer: "%{url}?%{param}"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; target_prefix: ""&nbsp; &nbsp; else:&nbsp; &nbsp; &nbsp; copy_fields:&nbsp; &nbsp; &nbsp; &nbsp; fields:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - from: uri&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; to: url</code></pre></div>
<div><pre><code>{&nbsp; "@timestamp": "2025-03-17T08:13:47.537Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "8.17.0"&nbsp; },&nbsp; "message": "1.2.3.4 - - [12/Oct/2024:02:42:00 +0900] \"GET /bbs/view.html HTTP/1.1\" 200 37727",&nbsp; "uri": "/bbs/view.html",&nbsp; "url": "/bbs/view.html"}{&nbsp; "@timestamp": "2025-03-17T08:13:47.537Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "8.17.0"&nbsp; },&nbsp; "message": "192.168.56.1 - - [12/Oct/2024:02:42:00 +0900] \"GET /bbs/view.php?board_id=kor%5Fmedia&amp;gul_no=1106&amp;idx=17&amp;m=4&amp;upage=25&amp;tpage=&amp;PAGE=4 HTTP/1.1\" 200 37727",&nbsp; "uri": "/bbs/view.php?board_id=kor%5Fmedia&amp;gul_no=1106&amp;idx=17&amp;m=4&amp;upage=25&amp;tpage=&amp;PAGE=4",&nbsp; "param": "board_id=kor%5Fmedia&amp;gul_no=1106&amp;idx=17&amp;m=4&amp;upage=25&amp;tpage=&amp;PAGE=4",&nbsp; "url": "/bbs/view.php"}</code></pre></div>
그런데 ingest pipeline은 <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#conditionally-run-processor" target="_blank">processor에 종속된 조건문</a>만을 지원한다. 다음은 ?가 없는 데이터를 처리하지 못하는 ingest pipeline.&nbsp;<div>POST _ingest/pipeline/_simulate{"pipeline": {"processors": [&nbsp; &nbsp; &nbsp; {"grok": {"field": "uri","patterns": ["(?&lt;url&gt;[^?]+)\\?(?&lt;param&gt;.*)"]&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; ]&nbsp; },"docs": [&nbsp; &nbsp; {"_source": {"uri": "index.php?a=b"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; {"_source": {"uri": "index.html"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; ]}</div>
<div><pre><code>{&nbsp; "docs": [&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; "doc": {&nbsp; &nbsp; &nbsp; &nbsp; "_index": "_index",&nbsp; &nbsp; &nbsp; &nbsp; "_version": "-3",&nbsp; &nbsp; &nbsp; &nbsp; "_id": "_id",&nbsp; &nbsp; &nbsp; &nbsp; "_source": {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "uri": "index.php?a=b",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "param": "a=b",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "url": "index.php"&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; "_ingest": {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "timestamp": "2025-03-17T08:23:55.1105587Z"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; "error": {&nbsp; &nbsp; &nbsp; &nbsp; "root_cause": [&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "type": "illegal_argument_exception",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "reason": "Provided Grok expressions do not match field value: [index.html]"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; ],&nbsp; &nbsp; &nbsp; &nbsp; "type": "illegal_argument_exception",&nbsp; &nbsp; &nbsp; &nbsp; "reason": "Provided Grok expressions do not match field value: [index.html]"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; ]}</code></pre></div>
? 조건을 주면 ?가 있는 데이터만을 처리한다.<div>POST _ingest/pipeline/_simulate{"pipeline": {"processors": [&nbsp; &nbsp; &nbsp; {"grok": {"field": "uri","patterns": ["(?&lt;url&gt;[^?]+)\\?(?&lt;param&gt;.*)"],"if": "ctx.uri.contains('?')"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; ]&nbsp; },"docs": [&nbsp; &nbsp; {"_source": {"uri": "index.php?a=b"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; {"_source": {"uri": "index.html"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; ]}</div><div>{"docs": [&nbsp; &nbsp; {"doc": {"_index": "_index","_version": "-3","_id": "_id","_source": {"uri": "index.php?a=b","param": "a=b","url": "index.php"&nbsp; &nbsp; &nbsp; &nbsp; },"_ingest": {"timestamp": "2025-03-17T08:27:14.3998071Z"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; {"doc": {"_index": "_index","_version": "-3","_id": "_id","_source": {"uri": "index.html"&nbsp; &nbsp; &nbsp; &nbsp; },"_ingest": {"timestamp": "2025-03-17T08:27:14.3998071Z"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; ]}</div>이때 해법은 정규표현식을 추가하거나,<div>POST _ingest/pipeline/_simulate{"pipeline": {"processors": [&nbsp; &nbsp; &nbsp; {"grok": {"field": "uri","patterns": ["(?&lt;url&gt;[^?]+)\\?(?&lt;param&gt;.*)", "(?&lt;url&gt;.*)"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ]&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; ]&nbsp; },"docs": [&nbsp; &nbsp; {"_source": {"uri": "index.php?a=b"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; {"_source": {"uri": "index.html"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; ]}</div><div>{"docs": [&nbsp; &nbsp; {"doc": {"_index": "_index","_version": "-3","_id": "_id","_source": {"uri": "index.php?a=b","param": "a=b","url": "index.php"&nbsp; &nbsp; &nbsp; &nbsp; },"_ingest": {"timestamp": "2025-03-17T08:35:46.6631911Z"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; {"doc": {"_index": "_index","_version": "-3","_id": "_id","_source": {"uri": "index.html","url": "index.html"&nbsp; &nbsp; &nbsp; &nbsp; },"_ingest": {"timestamp": "2025-03-17T08:35:46.6631911Z"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; ]}</div><div>POST _ingest/pipeline/_simulate{"pipeline": {"processors": [&nbsp; &nbsp; &nbsp; {"grok": {"field": "uri","patterns": ["(?&lt;url&gt;[^?]+)\\?(?&lt;param&gt;.*)"],"on_failure": [&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {"set": {"field": "url","copy_from": "uri"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ]&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; ]&nbsp; },"docs": [&nbsp; &nbsp; {"_source": {"uri": "index.php?a=b"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; {"_source": {"uri": "index.html"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; ]}</div><div>{"docs": [&nbsp; &nbsp; {"doc": {"_index": "_index","_version": "-3","_id": "_id","_source": {"uri": "index.php?a=b","param": "a=b","url": "index.php"&nbsp; &nbsp; &nbsp; &nbsp; },"_ingest": {"timestamp": "2025-03-17T08:38:37.0469351Z"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; {"doc": {"_index": "_index","_version": "-3","_id": "_id","_source": {"uri": "index.html","url": "index.html"&nbsp; &nbsp; &nbsp; &nbsp; },"_ingest": {"timestamp": "2025-03-17T08:38:37.0469351Z"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; ]}</div><div>POST _ingest/pipeline/_simulate{"pipeline": {"processors": [&nbsp; &nbsp; &nbsp; {"script": {"source": """if (ctx.uri.contains('?')) {def str = /([^?]+)\?(.*)/.matcher(ctx.uri);if (str.find()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ctx.url = str.group(1);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ctx.param = str.group(2);} &nbsp;} else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ctx.url = ctx.uri}&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; """&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; ]&nbsp; },"docs": [&nbsp; &nbsp; {"_source": {"uri": "index.php?a=b"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; {"_source": {"uri": "index.html"&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; ]}</div><div>{"docs": [&nbsp; &nbsp; {"doc": {"_index": "_index","_version": "-3","_id": "_id","_source": {"uri": "index.php?a=b","param": "a=b","url": "index.php"&nbsp; &nbsp; &nbsp; &nbsp; },"_ingest": {"timestamp": "2025-03-17T08:41:08.5446373Z"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; },&nbsp; &nbsp; {"doc": {"_index": "_index","_version": "-3","_id": "_id","_source": {"uri": "index.html","url": "index.html"&nbsp; &nbsp; &nbsp; &nbsp; },"_ingest": {"timestamp": "2025-03-17T08:41:08.5446373Z"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; ]}</div><div>관련 글<ul><li><a href="https://kangmyounghun.blogspot.com/2025/03/ingest-pipeline-5th.html">ingest pipeline - 5th</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/04/ingest-pipeline.html" target="">ingest pipeline</a></li><li><a href="https://kangmyounghun.blogspot.com/2022/04/logstash-fingerprint-2nd.html">엘라스틱의 해시 변환</a></li><li><a href="https://kangmyounghun.blogspot.com/2023/09/convert-ip-to-decimal.html">convert ip to decimal</a></li></ul></div>

</div></div>

케세라세라

로그스태시는 조건문으로 필터의 유기적인 실행 관계를 설정할 수 있다. beat processor도 마찬가지. 다음은 데이터 조건에 따라 달라지는 로그스태시 필터.
filter {
 mutate {
  remove_field => ["@timestamp", "@version", "path", "host"]
 }
 dissect {
  mapping => {"message" => '%{} "%{} %{uri} %{}" %{}'}
 }
 
if [uri] =~ '\?' {
  grok {
   match => {'uri' => '(?<url>[^?]+)\?(?<param>.*)'}
  }
 } else {
  mutate {
   copy => {'uri' => 'url'}
  }
 }
}
{
    "message" => "1.2.3.4 - - [12/Oct/2024:02:42:00 +0900] \"GET /bbs/view.html HTTP/1.1\" 200 37727\r",
        "uri" => "/bbs/view.html",
        "url" => "/bbs/view.html"
}
{
    "message" => "192.168.56.1 - - [12/Oct/2024:02:42:00 +0900] \"GET /bbs/view.php?board_id=kor%5Fmedia&gul_no=1106&idx=17&m=4&upage=25&tpage=&PAGE=4 HTTP/1.1\" 200 37727\r",
      "param" => "board_id=kor%5Fmedia&gul_no=1106&idx=17&m=4&upage=25&tpage=&PAGE=4",
        "uri" => "/bbs/view.php?board_id=kor%5Fmedia&gul_no=1106&idx=17&m=4&upage=25&tpage=&PAGE=4",
        "url" => "/bbs/view.php"
}
역시 데이터 조건에 따라 달라지는 beat processor.
processors:
  - include_fields:
      fields: "message"
  - dissect:
      tokenizer: '%{} "%{} %{uri} %{}" %{}'
      target_prefix: ""
  - if:
      contains.uri: "?"
    then:
      - dissect:
          field: "uri"
          tokenizer: "%{url}?%{param}"
          target_prefix: ""
    else:
      copy_fields:
        fields:
          - from: uri
            to: url
{
  "@timestamp": "2025-03-17T08:13:47.537Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "8.17.0"
  },
  "message": "1.2.3.4 - - [12/Oct/2024:02:42:00 +0900] \"GET /bbs/view.html HTTP/1.1\" 200 37727",
  "uri": "/bbs/view.html",
  "url": "/bbs/view.html"
}
{
  "@timestamp": "2025-03-17T08:13:47.537Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "8.17.0"
  },
  "message": "192.168.56.1 - - [12/Oct/2024:02:42:00 +0900] \"GET /bbs/view.php?board_id=kor%5Fmedia&gul_no=1106&idx=17&m=4&upage=25&tpage=&PAGE=4 HTTP/1.1\" 200 37727",
  "uri": "/bbs/view.php?board_id=kor%5Fmedia&gul_no=1106&idx=17&m=4&upage=25&tpage=&PAGE=4",
  "param": "board_id=kor%5Fmedia&gul_no=1106&idx=17&m=4&upage=25&tpage=&PAGE=4",
  "url": "/bbs/view.php"
}
그런데 ingest pipeline은 processor에 종속된 조건문만을 지원한다. 다음은 ?가 없는 데이터를 처리하지 못하는 ingest pipeline. 
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "grok": {
          "field": "uri",
          "patterns": ["(?<url>[^?]+)\\?(?<param>.*)"]
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "uri": "index.php?a=b"
      }
    },
    {
      "_source": {
        "uri": "index.html"
      }
    }
  ]
}
{
  "docs": [
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "uri": "index.php?a=b",
          "param": "a=b",
          "url": "index.php"
        },
        "_ingest": {
          "timestamp": "2025-03-17T08:23:55.1105587Z"
        }
      }
    },
    {
      "error": {
        "root_cause": [
          {
            "type": "illegal_argument_exception",
            "reason": "Provided Grok expressions do not match field value: [index.html]"
          }
        ],
        "type": "illegal_argument_exception",
        "reason": "Provided Grok expressions do not match field value: [index.html]"
      }
    }
  ]
}
? 조건을 주면 ?가 있는 데이터만을 처리한다.
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "grok": {
          "field": "uri",
          "patterns": ["(?<url>[^?]+)\\?(?<param>.*)"],
          "if": "ctx.uri.contains('?')"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "uri": "index.php?a=b"
      }
    },
    {
      "_source": {
        "uri": "index.html"
      }
    }
  ]
}
{
  "docs": [
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "uri": "index.php?a=b",
          "param": "a=b",
          "url": "index.php"
        },
        "_ingest": {
          "timestamp": "2025-03-17T08:27:14.3998071Z"
        }
      }
    },
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "uri": "index.html"
        },
        "_ingest": {
          "timestamp": "2025-03-17T08:27:14.3998071Z"
        }
      }
    }
  ]
}
이때 해법은 정규표현식을 추가하거나,
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "grok": {
          "field": "uri",
          "patterns": [
            "(?<url>[^?]+)\\?(?<param>.*)", 
            "(?<url>.*)"
          ]
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "uri": "index.php?a=b"
      }
    },
    {
      "_source": {
        "uri": "index.html"
      }
    }
  ]
}
{
  "docs": [
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "uri": "index.php?a=b",
          "param": "a=b",
          "url": "index.php"
        },
        "_ingest": {
          "timestamp": "2025-03-17T08:35:46.6631911Z"
        }
      }
    },
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "uri": "index.html",
          "url": "index.html"
        },
        "_ingest": {
          "timestamp": "2025-03-17T08:35:46.6631911Z"
        }
      }
    }
  ]
}
on_failure 옵션으로 예외처리를 하거나,
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "grok": {
          "field": "uri",
          "patterns": ["(?<url>[^?]+)\\?(?<param>.*)"],
          "on_failure": [
            {
              "set": {
                "field": "url",
                "copy_from": "uri"
              }
            }
          ]
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "uri": "index.php?a=b"
      }
    },
    {
      "_source": {
        "uri": "index.html"
      }
    }
  ]
}
{
  "docs": [
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "uri": "index.php?a=b",
          "param": "a=b",
          "url": "index.php"
        },
        "_ingest": {
          "timestamp": "2025-03-17T08:38:37.0469351Z"
        }
      }
    },
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "uri": "index.html",
          "url": "index.html"
        },
        "_ingest": {
          "timestamp": "2025-03-17T08:38:37.0469351Z"
        }
      }
    }
  ]
}
script processor를 사용하거나.
POST _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "script": {
          "source": """
            if (ctx.uri.contains('?')) {
              def str = /([^?]+)\?(.*)/.matcher(ctx.uri);
              if (str.find()) {
                ctx.url = str.group(1);
                ctx.param = str.group(2);
              }  
            } else {
              ctx.url = ctx.uri
            }
          """
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "uri": "index.php?a=b"
      }
    },
    {
      "_source": {
        "uri": "index.html"
      }
    }
  ]
}
{
  "docs": [
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "uri": "index.php?a=b",
          "param": "a=b",
          "url": "index.php"
        },
        "_ingest": {
          "timestamp": "2025-03-17T08:41:08.5446373Z"
        }
      }
    },
    {
      "doc": {
        "_index": "_index",
        "_version": "-3",
        "_id": "_id",
        "_source": {
          "uri": "index.html",
          "url": "index.html"
        },
        "_ingest": {
          "timestamp": "2025-03-17T08:41:08.5446373Z"
        }
      }
    }
  ]
}
관련 글
ingest pipeline - 5th
ingest pipeline
엘라스틱의 해시 변환
convert ip to decimal

ingest pipeline - 6th

댓글