63 lines
1.8 KiB
YAML
63 lines
1.8 KiB
YAML
# filebeat-config.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: filebeat-config
|
|
namespace: efk
|
|
data:
|
|
filebeat.yml: |
|
|
filebeat.inputs:
|
|
- type: http_endpoint
|
|
enabled: true
|
|
listen_address: 0.0.0.0:8888
|
|
path: "/"
|
|
json.keys_under_root: true
|
|
|
|
processors:
|
|
# 提取路径中的变量（严格模式）
|
|
- dissect:
|
|
tokenizer: "/tanya.candle.%{currency}.%{year}.%{interval}"
|
|
field: "http.request.path"
|
|
target_prefix: ""
|
|
ignore_missing: false # 关键：关闭忽略缺失
|
|
|
|
# 强制设置默认值（即使字段为空）
|
|
- script:
|
|
lang: javascript
|
|
source: |
|
|
function process(event) {
|
|
// 先检查字段是否存在，不存在则设置默认值
|
|
if (!event.containsKey('currency') || event.get('currency') === '') {
|
|
event.put('currency', 'unknown');
|
|
}
|
|
if (!event.containsKey('year') || event.get('year') === '') {
|
|
event.put('year', '0000');
|
|
}
|
|
if (!event.containsKey('interval') || event.get('interval') === '') {
|
|
event.put('interval', '0D');
|
|
}
|
|
}
|
|
|
|
output.elasticsearch:
|
|
hosts: ["http://elasticsearch:9200"]
|
|
username: "fluentd_user"
|
|
password: "fluentd_password"
|
|
indices:
|
|
- index: "logstash-candle-${currency}-${year}-${interval}"
|
|
# 严格验证字段值非空
|
|
when.and:
|
|
- not.equals:
|
|
currency: ""
|
|
- not.equals:
|
|
year: ""
|
|
- not.equals:
|
|
interval: ""
|
|
- index: "fallback-index"
|
|
when.or:
|
|
- equals:
|
|
currency: ""
|
|
- equals:
|
|
year: ""
|
|
- equals:
|
|
interval: ""
|