"Message" => "10.252.142.174 [12/sep/2016:16:43:47 +0800] \" get/resources/js/toolbar.49fc367e.js?_v= ${last.updated}&_=1473669825443 http/1.1\ "-1800 \" Https://www.zjcap.cn/products/buyTransferProduct.html? Followid=1c041a4c-a9fb-48bf-9c0a-1e10aea81f8f\ "\" mozilla/5.0 (Windows NT 10.0; WOW64) applewebkit/537.36 (khtml, like Gecko) chrome/45.0.2454.101 safari/537.36\ "0.000 218.0.248.244", " @version "=>" 1 "," @timestamp "=>" 2016-09-12t08:44:13.113z "," Path "=>"/data0
1/applog_backup/zjzc_log/zj-frontend01-access.2016-09-12 "," host "=>" dr-mysql01.zjcap.com ", "Type" => "zj_frontend_access", "ClientIP" => "10.252.142.174", "t IME "=>" 12/sep/2016:16:43:47 +0800, "verb" => "get", "Request =>"/resour
Ces/js/toolbar.49fc367e.js "," Httpversion "=>" 1.1 ", "Http_status_code" => "," "bytes" => "1800", "Http_referer" => "https://www". zjcap.cn/products/buytransferproduct.html?followid=1c041a4c-a9fb-48bf-9c0a-1e10aea81f8f "," Http_user_agent "=> ; "Mozilla/5.0 (Windows NT 10.0; WOW64) applewebkit/537.36 (khtml, like Gecko) chrome/45.0.2454.101 safari/537.36 ", http_x_forwarded_for" => "218.0 .248.244 "," GeoIP "=> {" IP "=>" 218.0.248.244 "," Country_code2 " => "CN", "Country_code3" => "CHN", "Country_name" => "the", "Continent_code" => "as", "Region_name" => "," "City_name" => "Hangzhou", "latitude" => 30.293599999999998, "longitude" => 120.16140000000001, "timezone" => "Asia/sha" Nghai "," Real_region_name "=>" Zhejiang "," Location "=> [[0] 120.16140000000001, [1] 30.293599999999998], "coordinates" => [[0] 120.16140000000
001, [1] 30.293599999999998]}, "Response_time" => 0.0} geoip { SOURCE => "Http_x_forwarded_for" target => "GeoIP" D Atabase => "/usr/local/logstash-2.3.4/etc/geolitecity.dat" Add_field => ["[Geoip][coordinat ES] ","%{[geoip][longitude]} "] Add_field => [" [Geoip][coordinates] ","%{[geoip][latitude]} "
]} mutate {convert => [[geoip][coordinates], float] Convert => ["Request_time", "float"] add_field =>["Response_time", "%{req Uest_time} "] Convert => [" Response_time "," float "] Remove_field =>[
"Request_time"]
At present, only this stupid way to implement, convert Request_time to float I remember the last time I had written an article on how to calculate the average, that is, in Logstash agent.conf The data is int or float float, otherwise ... If it is not a number, then you will find that you are in the Kibana of the steps, there is no number field to choose from.