elasticsearch 从Logstash conf文件中而不是从Elsaticsearch puts中设置属性/字段类型?,elasticsearch,logstash,logstash-configuration,elasticsearch,Logstash,Logstash Configuration" /> elasticsearch 从Logstash conf文件中而不是从Elsaticsearch puts中设置属性/字段类型?,elasticsearch,logstash,logstash-configuration,elasticsearch,Logstash,Logstash Configuration" />

elasticsearch 从Logstash conf文件中而不是从Elsaticsearch puts中设置属性/字段类型?

elasticsearch 从Logstash conf文件中而不是从Elsaticsearch puts中设置属性/字段类型?,elasticsearch,logstash,logstash-configuration,elasticsearch,Logstash,Logstash Configuration,我将数据从logstash推送到elasticsearch,但我注意到数据类型不匹配。我有地理点是字符串,日期是字符串,等等 如何从logstash conf文件中设置字段类型?我已经看到我可以使用命令来更改类型,但是由于我每天都创建一个新的索引,所以我也不想自动执行这些命令 我想有一种方法可以从conf文件、过滤器或输出中完成。我只是不知道去哪里,怎么去 这就是我一直在做的事情 input { http_poller { ... } }

我将数据从logstash推送到elasticsearch,但我注意到数据类型不匹配。我有地理点是字符串,日期是字符串,等等

如何从logstash conf文件中设置字段类型?我已经看到我可以使用命令来更改类型,但是由于我每天都创建一个新的索引,所以我也不想自动执行这些命令

我想有一种方法可以从conf文件、过滤器或输出中完成。我只是不知道去哪里,怎么去

这就是我一直在做的事情

    input {
      http_poller {
         ...
      }
    }
    
    filter {
      split {
        field => "[bustime-response][vehicle]"
      }
      mutate {
        rename => {
          "[bustime-response][vehicle][vid]" => "vid"
          "[bustime-response][vehicle][rtpidatafeed]" => "rtpidatafeed"
          "[bustime-response][vehicle][tmstmp]" => "tmstmp"
          "[bustime-response][vehicle][lat]" => "lat"
          "[bustime-response][vehicle][lon]" => "lon"
          "[bustime-response][vehicle][hdg]" => "hdg"
          "[bustime-response][vehicle][pid]" => "pid"
          "[bustime-response][vehicle][rt]" => "rt"
          "[bustime-response][vehicle][des]" => "des"
          "[bustime-response][vehicle][pdist]" => "pdist"
          "[bustime-response][vehicle][dly]" => "dly"
          "[bustime-response][vehicle][spd]" => "spd"
          "[bustime-response][vehicle][tatripid]" => "tatripid"
          "[bustime-response][vehicle][origtatripno]" => "origtatripno"
          "[bustime-response][vehicle][tablockid]" => "tablockid"
          "[bustime-response][vehicle][zone]" => "zone"
          "[bustime-response][vehicle][mode]" => "mode"
          "[bustime-response][vehicle][psgld]" => "psgld"
        }
      }
      mutate {
        add_field => { "location" => "%{lat},%{lon}" }
      }
    }

    output {
      elasticsearch {
        hosts => [ "${ES_HOSTS}" ]
        user => "${ES_USER}"
        password => "${ES_PASSWORD}"
        cacert => '/etc/logstash/certificates/ca.crt'
        index => "transit-pittsburgh-%{+YYYY.MM.dd}"
      }