本文介紹如何動態構建新欄位,將現有日誌封裝成一個整體,添加到新構建的欄位中。
樣本:您可以使用如下加工文法複製欄位content為k1_content_copy、欄位name為k2_name_copy、欄位School為k3_school_copy,並將加工後的日誌封裝成一個整體。然後再構建一個新欄位__extract_others__,將日誌添加到該欄位中,並丟棄欄位k1_content_copy和k3_school_copy。
資料加工(舊版)
加工規則
e_set("k1_content_copy", v("content"), "k2_name_copy", v("name"), "k3_school_copy", v("School"))
e_set("__extract_others__", dct_delete(KEEP,"k1_content_copy","k3_school_copy"))
原始日誌
School: CMU
__source__: 192.168.1.1
__tag__:__client_ip__: 192.168.1.2
_tag__:__receive_time__:1591755799
__topic__:
content:test concent
name: Twish
輸出日誌
School:CMU
__extract_others__:{"__time__": "1591755799", "__topic__": "", "__source__": "192.168.1.1", "__tag__:__client_ip__": "192.168.1.2", "__tag__:__receive_time__": "1591755799", "content": "test content", "name": "Twish", "School": "CMU", "k2_name_copy": "Twish"}
__source__:192.168.1.1
__tag__:__client_ip__:192.168.1.2
__tag__:__receive_time__:1591755799
__topic__:
content:test content
k2_name_copy:Twish
name:Twish