<div id="readability-page-1" class="page"><div id="post-body-4359500845973465569" itemprop="articleBody">
<p>공백으로 구분된 데이터.</p>
<div><pre><code><p>[2025-01-14T21:09:09,525][INFO ][logstash.agent&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;] Pipelines running {:count=&gt;1, :running_pipelines=&gt;[:main], :non_running_pipelines=&gt;[]}</p><p>{</p><p>&nbsp; &nbsp; "message" =&gt; "a b c\r"</p><p>}</p></code></pre></div>
<p>mutate 필터의 split 옵션을 적용하면 다중값 구조로 바뀐다.</p><div><pre><code><p>filter {</p><p>&nbsp;mutate {</p><p>&nbsp; remove_field =&gt; ["host", "@version", "path", "@timestamp"]</p><p>&nbsp; split =&gt; {"message" =&gt; " "}</p><p>&nbsp;}</p><p>}</p></code></pre></div>
<div><pre><code><p>[2025-01-14T21:10:57,408][INFO ][logstash.agent           ] Pipelines running {:count=&gt;1, :running_pipelines=&gt;[:main], :non_running_pipelines=&gt;[]}</p><p>{
    "message" =&gt; [
        [0] "a",
        [1] "b",
        [2] "c"
    ]
}</p></code></pre></div><p>해당 필드에 <a href="https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html" target="_blank">split 필터</a>를 적용하면 다중값을 개별 이벤트로 분리.</p><div><pre><code><p>filter {</p><p> mutate {
  remove_field =&gt; ["@timestamp", "@version", "path", "host"]
  split =&gt; {"message" =&gt; " "}
 }

 split {}
}</p></code></pre></div><div><pre><code><p>[2025-01-14T21:12:54,283][INFO ][logstash.agent           ] Pipelines running {:count=&gt;1, :running_pipelines=&gt;[:main], :non_running_pipelines=&gt;[]}</p><p>{
    "@timestamp" =&gt; 2025-01-14T12:12:54.389256Z,
      "@version" =&gt; "1",
       "message" =&gt; "a"
}
{
    "@timestamp" =&gt; 2025-01-14T12:12:54.389256Z,
      "@version" =&gt; "1",
       "message" =&gt; "b"
}
{
    "@timestamp" =&gt; 2025-01-14T12:12:54.389256Z,
      "@version" =&gt; "1",
       "message" =&gt; "c"
}</p></code></pre></div>
<p>이걸 원한 게 아닌데<span>(..)</span></p><div><p><b>관련 글</b></p><ul><li><a href="http://kangmyounghun.blogspot.com/2017/06/elasticsearch-grok.html" target="_blank">Logstash 필터 grok</a></li><li><span><a href="http://kangmyounghun.blogspot.com/2017/07/logstash-mutate.html" target="_blank">Logstash 필터 mutate</a></span></li><li><span><a href="http://kangmyounghun.blogspot.kr/2017/10/logstash-ruby.html" target="_blank">Logstash 필터 ruby</a></span></li><li><span><a href="http://kangmyounghun.blogspot.kr/2018/02/logstash-geoip.html" target="_blank">Logstash 필터&nbsp;geoip</a></span></li><li><span><a href="http://kangmyounghun.blogspot.kr/2018/04/logstash-dissect.html" target="_blank">Logstash 필터 dissect</a></span></li><li><a href="http://kangmyounghun.blogspot.com/2018/09/logstash-kv.html" target="_blank">Logstash 필터&nbsp;kv</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/01/logstash-date.html" target="_blank">Logstash 필터 date</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/02/logstash-translate.html" target="_blank">Logstash 필터 translate</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/08/logstash-drop.html" target="_blank">Logstash 필터 drop</a></li><li><a href="https://kangmyounghun.blogspot.com/2019/11/logstash-useragent.html" target="_blank">Logstash 필터 useragent</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/04/logstash-fingerprint.html" target="_blank">logstash 필터 fingerprint</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/02/logstash-elapsed.html" target="_blank">Logstash 필터 elapsed</a></li><li><a href="https://kangmyounghun.blogspot.com/2022/12/logstash-csv.html" target="_blank">Logstash 필터 csv</a></li><li><a href="https://kangmyounghun.blogspot.com/2023/11/logstash-dns.html">Logstash 필터 dns</a></li><li><a href="https://kangmyounghun.blogspot.com/2020/02/logstash-codec-multiline.html" target="_blank">Logstash codec 플러그인 multiline</a></li></ul></div>

</div></div>

케세라세라

공백으로 구분된 데이터.
[2025-01-14T21:09:09,525][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
{
    "message" => "a b c\r"
}
mutate 필터의 split 옵션을 적용하면 다중값 구조로 바뀐다.
filter {
 mutate {
  remove_field => ["host", "@version", "path", "@timestamp"]
  split => {"message" => " "}
 }
}
[2025-01-14T21:10:57,408][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
{
    "message" => [
        [0] "a",
        [1] "b",
        [2] "c"
    ]
}
해당 필드에 split 필터를 적용하면 다중값을 개별 이벤트로 분리.
filter {
 mutate {
  remove_field => ["@timestamp", "@version", "path", "host"]
  split => {"message" => " "}
 }
 split {}
}
[2025-01-14T21:12:54,283][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
{
    "@timestamp" => 2025-01-14T12:12:54.389256Z,
      "@version" => "1",
       "message" => "a"
}
{
    "@timestamp" => 2025-01-14T12:12:54.389256Z,
      "@version" => "1",
       "message" => "b"
}
{
    "@timestamp" => 2025-01-14T12:12:54.389256Z,
      "@version" => "1",
       "message" => "c"
}
이걸 원한 게 아닌데(..)
관련 글
Logstash 필터 grok
Logstash 필터 mutate
Logstash 필터 ruby
Logstash 필터 geoip
Logstash 필터 dissect
Logstash 필터 kv
Logstash 필터 date
Logstash 필터 translate
Logstash 필터 drop
Logstash 필터 useragent
logstash 필터 fingerprint
Logstash 필터 elapsed
Logstash 필터 csv
Logstash 필터 dns
Logstash codec 플러그인 multiline

Logstash 필터 split

댓글