Logstash 导入 csv文件的坑坑们

Input注意

input 
{
	file 
	{
		path => ["D:/20191111_RES.csv"]  # 文件路径必须以 ‘/’而不是‘\’ 进行分割，即便是Windows
		start_position => "beginning"
		sincedb_path => "D:/testt" # 记录文件的位置，也要以‘/’而不是‘\’进行分割，这里必须指定文件名
		type => "mytype" 
	}
	stdin{
    }
} 

Filter注意

filter 
{
	if [type] == "noxdb"
	{
		date
		{
		match => ["measuredate", "yyyy-MM-dd HH:mm:ss"]
		target => "@timestamp"
		}
	}
	if [type] == "apb"
	{
		csv 
		{
			separator => ","
			columns => ["datetime","imagename","cie_pos","cie_width","duration","pix_left", "pix_right" ,"pix_top","cognex_pos","cognex_width","cognex_seamless","globalresult","jobname","exposure","gain","offset"]
			convert => 
			{
				"cie_pos" => "float"
				"cie_width" => "float"
				"duration" => "float"
				"pix_left" => "integer"
				"pix_right" => "integer"
				"pix_top" => "integer"
				"cognex_pos" => "float"
				"cognex_width" => "float"
				"cognex_seamless" => "float"
				"globalresult" => "float"
				"exposure" => "float"
				"gain" => "float"
				"offset" => "float"			
			}
		}
		date 
		{
			match => ["datetime", "yyyyMMddHHmmss"]
		}	
		json
		{
			source => "message" remove_field => ["message"] # 这句貌似没起作用，待查
		}		
	}
}
	

Output注意

output
{
	if [type]=="noxdb"
	{
		elasticsearch
		{ 
			hosts => "127.0.0.1:9200"
			index=> "logstash-noxdb"
			document_id => "%{id}"
			user => logstash_internal
			password => xxxxxx
		}
	}
	if [type] == "apb"
	{
		elasticsearch 
		{ 
			hosts => "127.0.0.1:9200"
			index=> "logstash-injector-apb"
			user => logstash_internal
			password => xxxxxx
		}
	}
	stdout
	{
		codec => "json_lines"
	}
}