![http]( "http")
本文介绍了尝试使用ElasticSearch输出创建与请求路径值同名的索引时发生无效的FieldReference的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！ 问题描述 29岁程序员，3月因学历无情被辞！ 这是我的 logstash.conf 文件：input { http { host => "127.0.0.1" port => 31311 }}filter { mutate { split => ["%{headers.request_path}", "/"] add_field => { "index_id" => "%{headers.request_path[0]}" } add_field => { "document_id" => "%{headers.request_path[1]}" } }}output { elasticsearch { hosts => "http://localhost:9200" index => "%{index_id}" document_id => "%{document_id}" } stdout { codec => "rubydebug" }}当我发送 PUT 请求，例如我希望创建一个名称为 twitter ，而不是使用ElasticSearchI want a new index to be created with the name twitter, instead of using the ElasticSearch default.但是，Logstash立即崩溃，并显示以下（已截断的）错误消息：However, Logstash crashes immediately with the following (truncated) error message:我确定我在某个地方犯了语法错误，但是我看不到它在哪里。我该如何解决？I am sure I have made a syntax error somewhere, but I can't see where it is. How can I fix this? 编辑：我将 filter 段更改为以下内容：The same error occurs when I change the filter segment to the following:filter { mutate { split => ["%{[headers][request_path]}", "/"] add_field => { "index_id" => "%{[headers][request_path][0]}" } add_field => { "document_id" => "%{[headers][request_path][1]}" } }}推荐答案要拆分字段，请使用％{foo} 语法。。另外，您应该从数组的位置[1]开始，因为在位置[0]处将有一个空字符串（ ），原因是没有第一个分隔符（ / ）左侧的字符。相反，您的过滤器部分应该是这样的：To split the field the %{foo} syntax is not used. Also you should start at position [1] of the array, because in position [0] there will be an empty string("") due to the reason that there are no characters at the left of the first separator(/). Instead, your filter section should be something like this: filter { mutate { split => ["[headers][request_path]", "/"] add_field => { "index_id" => "%{[headers][request_path][1]}" } add_field => { "document_id" => "%{[headers][request_path][2]}" } }}您现在可以使用％{index_id} 和％{document_id} 中的值。我使用 logstash 6.5.3 版本对此进行了测试，并使用邮递员发送了 http://127.0.0.1:31311/twitter/1 'HTTP请求，控制台中的输出如下：You can now use the value in %{index_id} and %{document_id}. I tested this using logstash 6.5.3 version and used Postman to send the 'http://127.0.0.1:31311/twitter/1' HTTP request and the output in console was as follows:{ "message" => "", "index_id" => "twitter", "document_id" => "1", "@version" => "1", "host" => "127.0.0.1", "@timestamp" => 2019-04-09T12:15:47.098Z, "headers" => { "connection" => "keep-alive", "http_version" => "HTTP/1.1", "http_accept" => "*/*", "cache_control" => "no-cache", "content_length" => "0", "postman_token" => "cb81754f-6d1c-4e31-ac94-fde50c0fdbf8", "accept_encoding" => "gzip, deflate", "request_path" => [ [0] "", [1] "twitter", [2] "1" ], "http_host" => "127.0.0.1:31311", "http_user_agent" => "PostmanRuntime/7.6.1", "request_method" => "PUT" }}配置的输出部分不更改。因此，最终的logstash.conf文件将如下所示：The output section of your configuration does not change. So, your final logstash.conf file will be something like this:input { http { host => "127.0.0.1" port => 31311 }}filter { mutate { split => ["[headers][request_path]", "/"] add_field => { "index_id" => "%{[headers][request_path][1]}" } add_field => { "document_id" => "%{[headers][request_path][2]}" } }}output { elasticsearch { hosts => "http://localhost:9200" index => "%{index_id}" document_id => "%{document_id}" } stdout { codec => "rubydebug" }} 这篇关于尝试使用ElasticSearch输出创建与请求路径值同名的索引时发生无效的FieldReference的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！ 上岸，阿里云！ 06-29 21:50