本文介紹如何動態構建新字段,將現有日志包裝成一個整體,添加到新構建的字段中。
示例:您可以使用如下加工語法復制字段content為k1_content_copy、字段name為k2_name_copy、字段School為k3_school_copy,并將加工后的日志包裝成一個整體。然后再構建一個新字段__extract_others__,將日志添加到該字段中,并丟棄字段k1_content_copy和k3_school_copy。
數據加工(舊版)
加工規則
e_set("k1_content_copy", v("content"), "k2_name_copy", v("name"), "k3_school_copy", v("School"))
e_set("__extract_others__", dct_delete(KEEP,"k1_content_copy","k3_school_copy"))
原始日志
School: CMU
__source__: 192.168.1.1
__tag__:__client_ip__: 192.168.1.2
_tag__:__receive_time__:1591755799
__topic__:
content:test concent
name: Twish
輸出日志
School:CMU
__extract_others__:{"__time__": "1591755799", "__topic__": "", "__source__": "192.168.1.1", "__tag__:__client_ip__": "192.168.1.2", "__tag__:__receive_time__": "1591755799", "content": "test content", "name": "Twish", "School": "CMU", "k2_name_copy": "Twish"}
__source__:192.168.1.1
__tag__:__client_ip__:192.168.1.2
__tag__:__receive_time__:1591755799
__topic__:
content:test content
k2_name_copy:Twish
name:Twish
文檔內容是否對您有幫助?