linux - Logstash:替换匹配模式的字段值

Question

我正在使用 Elasticsearch + Logstash + kibana 进行 Windows 事件日志分析。我得到以下日志:

{
  "_index": "logstash-2015.04.16",
  "_type": "logs",
  "_id": "Ov498b0cTqK8W4_IPzZKbg",
  "_score": null,
  "_source": {
    "EventTime": "2015-04-16 14:12:45",
    "EventType": "AUDIT_FAILURE",
    "EventID": "4656",
    "Message": "A handle to an object was     requested.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-21-2832557239-2908104349-351431359-3166\r\n\tAccount Name:\t\ts.tekotin\r\n\tAccount Domain:\t\tIAS\r\n\tLogon ID:\t\t0x88991C8\r\n\r\nObject:\r\n\tObject Server:\t\tSecurity\r\n\tObject Type:\t\tFile\r\n\tObject Name:\t\tC:\\Folders\\Общая (HotSMS)\\Test_folder\\3\r\n\tHandle ID:\t\t0x0\r\n\tResource Attributes:\t-\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x4\r\n\tProcess Name:\t\t\r\n\r\nAccess Request Information:\r\n\tTransaction ID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\tAccesses:\t\tReadData (or ListDirectory)\r\n\t\t\t\tReadAttributes\r\n\t\t\t\t\r\n\tAccess Reasons:\t\tReadData (or ListDirectory):\tDenied by\tD:(D;OICI;CCDCLCSWRPWPLOCRSDRC;;;S-1-5-21-2832557239-2908104349-351431359-3166)\r\n\t\t\t\tReadAttributes:\tGranted by ACE on parent folder\tD:(A;OICI;0x1200a9;;;S-1-5-21-2832557239-2908104349-351431359-3166)\r\n\t\t\t\t\r\n\tAccess Mask:\t\t0x81\r\n\tPrivileges Used for Access Check:\t-\r\n\tRestricted SID Count:\t0",
"ObjectServer": "Security",
"ObjectName": "C:\\Folders\\Общая (HotSMS)\\Test_folder\\3",
"HandleId": "0x0",
"PrivilegeList": "-",
"RestrictedSidCount": "0",
"ResourceAttributes": "-",
"@timestamp": "2015-04-16T11:12:45.802Z"
  },
  "sort": [
    1429182765802,
    1429182765802
  ]
}

我收到许多具有不同 EventID 的日志消息，当我收到 EventID 4656 的日志条目时 - 我想用字符串“访问失败”替换值“4656”。有机会这样做吗？

Answer 1

您可以在使用logstash加载时执行此操作 - 只需执行以下操作:

filter {
  if [EventID] == "4656" {
    mutate {
      replace => [ "EventID", "Access Failure" ]
    }
  }
}