我想从我在客户机上的logstash-forwarder中设置的'Application'字段的值创建索引.例如:在CRM客户端的logstash-forwarder.conf中,我写道
{
"paths": [
"/var/log/crm/crmERROR.log"
],
"fields": {**"**Application**":"CRM"**,"Sub-System":"Mysystem", "type":"Error-logs "
}
in LSF config on sales client 2 I say
{
"paths": [
"/var/log/sales/SalesERROR.log"
],
"fields": {**"Application":"Sales"**,"Sub-System":"Myststem", "type":"Error-logs "
}
所有这些日志将通过LS-shipper发送到redis.LS-indexer将从redis中获取它.现在在LS-Indexer中,我想根据字段"Application"(CRM,Sales)的值创建索引.如何获取Application字段的这些值,以便我可以在输出中使用它来创建indexname.
br,苏尼尔.
logstash ×1