小编ban*_*anu的帖子

尝试通过 logstash 更新 elasticsearch 中的特定字段。是否可以通过 logstash 仅更新一组字段？

请找到下面的代码，

    input {
  file {
        path => "/**/**/logstash/bin/*.log"
        start_position => "beginning"
        sincedb_path => "/dev/null"
        type => "multi"
  }
}

filter {
        csv {
                separator => "|"
                columns => ["GEOREFID","COUNTRYNAME", "G_COUNTRY", "G_UPDATE", "G_DELETE",  "D_COUNTRY", "D_UPDATE", "D_DELETE"]

}
elasticsearch {
         hosts => ["localhost:9200"]
         index => "logstash-data-monitor"
         query => "GEOREFID:%{GEOREFID}"
         fields => [["JSON_COUNTRY","G_COUNTRY"],
                    ["XML_COUNTRY","D_COUNTRY"]]
           }

if [G_COUNTRY] {
mutate {
    update => { "D_COUNTRY" => "%{D_COUNTRY}"
 }
  }
}
}
output {
elasticsearch {
        hosts => …