"message" => " 10.252.142.174 [12/Sep/2016:16:43:47 +0800] \"GET /resources/js/toolbar.49fc367e.js?_v=${last.updated}&_=1473669825443 HTTP/1.1\" - 200 1800 \"https://www.zjcap.cn/products/buyTransferProduct.html?followId=1c041a4c-a9fb-48bf-9c0a-1e10aea81f8f\" \"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36\" 0.000 218.0.248.244", "@version" => "1", "@timestamp" => "2016-09-12T08:44:13.113Z", "path" => "/data01/applog_backup/zjzc_log/zj-frontend01-access.2016-09-12", "host" => "dr-mysql01.zjcap.com", "type" => "zj_frontend_access", "clientip" => "10.252.142.174", "time" => "12/Sep/2016:16:43:47 +0800", "verb" => "GET", "request" => "/resources/js/toolbar.49fc367e.js", "httpversion" => "1.1", "http_status_code" => "200", "bytes" => "1800", "http_referer" => "https://www.zjcap.cn/products/buyTransferProduct.html?followId=1c041a4c-a9fb-48bf-9c0a-1e10aea81f8f", "http_user_agent" => "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36", "http_x_forwarded_for" => "218.0.248.244", "geoip" => { "ip" => "218.0.248.244", "country_code2" => "CN", "country_code3" => "CHN", "country_name" => "China", "continent_code" => "AS", "region_name" => "02", "city_name" => "Hangzhou", "latitude" => 30.293599999999998, "longitude" => 120.16140000000001, "timezone" => "Asia/Shanghai", "real_region_name" => "Zhejiang", "location" => [ [0] 120.16140000000001, [1] 30.293599999999998 ], "coordinates" => [ [0] 120.16140000000001, [1] 30.293599999999998 ] }, "response_time" => 0.0} geoip { source => "http_x_forwarded_for" target => "geoip" database => "/usr/local/logstash-2.3.4/etc/GeoLiteCity.dat" add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ] add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ] } mutate { convert => [ "[geoip][coordinates]", "float"] convert => [ "request_time", "float"] add_field =>["response_time","%{request_time}"] convert => [ "response_time", "float"] remove_field =>["request_time"] }目前只有這種笨辦法來實現,將request_time 轉換為float我記得上次已經寫過一篇關於如何計算平均值的,就是在logstash agent.conf 裡面標註資料是int或者是float浮點,不然搞不定的… 如果不是數字,那麼你會發現,你在kibana的求值那步驟,沒有數字field可以選擇。
<img src="https://img-blog.csdn.net/20160912174136627?watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQv/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/dissolve/70/gravity/Center" alt="" />