message中有部分内容是url格式，如何转化这部分内容
input {
file {
path => ["/elk/log/url.csv"]
start_position => "beginning"
codec => plain {charset => "UTF-8"}
}
}
filter {
grok {
match => {
"message" => "%{GREEDYDATA:prompt}"
}
}
#字符替换
# mutate {
# gsub => ["prompt","%5b","["]
# gsub => ["prompt","%20"," "]
# gsub => ["prompt","%5d","]"]
# gsub => ["prompt","%24","$"]
# }
#url解码
urldecode {
field => prompt
}
}
output {
elasticsearch {
hosts => ["192.168.80.128:9200"]
index => "url"
document_type => "url"
}
}
全局的编码问题
input {
tcp {
port=>port
codec => json_lines
}
}
