Filter

選擇對應的插件，過濾或修改指定的數據。

Plugins list

dissect {
    mapping => {
        'message' => '[%{time_iso8601}] %{remote_addr}:%{remote_port}'
    }
}

geoip {
    source => "remote_addr"
    add_tag => ["geoip"]
}

useragent {
                source => "http_user_agent"
                target => "machine"
}