logstash : Mutate { gsub … } not working

问题:

    mutate {
        add_field => {"eee" => "2016 uaie"}
        gsub => [
            "eee", "2016", "2015"
        ]
   }

This will indeed create a field "eee", but gsub will not update it. Why?

回答1:

add_field runs when the underlying filter succeeds. In your case, the mutate{} is being run and then the add_field is run.

To have the mutate{} after the field is added, use two mutate blocks:

mutate {
    add_field => {"eee" => "2016 uaie"}
}

mutate {
    gsub => [
        "eee", "2016", "2015"
    ]
}