elasticsearch - Logstash 6.2.3检测到6.x及更高版本的群集: `type`事件字段将不会用于确定文档_type

Question

当我使用下面给出的配置启动logstash时收到此警告。
如果类型已被删除，则如何将多个jdbc输入映射到称为“机构”和“订户”的seaparate索引。如何定义输出以进行 flex 搜索。

input {
jdbc {
jdbc_driver_library => "mysql-connector-java-5.1.44.jar"
jdbc_driver_class => "com.mysql.jdbc.Driver"
jdbc_connection_string => "jdbc:mysql://localhost:3306/dbname"
jdbc_user => "XXXX"
jdbc_password => "XXXX"
jdbc_paging_enabled => "true"
jdbc_fetch_size  => 500
lowercase_column_names => "false"
schedule => "* * * * * *"
last_run_metadata_path => "\RunConfig\logpos\agency_last_run"
statement_filepath => "\RunConfig\sql\agency.sql"
type => "agencydetails"

 }

 jdbc {
  type => "subscriberdetails"
  jdbc_driver_library => "mysql-connector-java-5.1.44.jar"
  jdbc_driver_class => "com.mysql.jdbc.Driver"
  jdbc_connection_string => "jdbc:mysql://localhost:3306/dbname"
  jdbc_user => "XXXX"
  jdbc_password => "XXXX"
  jdbc_paging_enabled => "true"
  jdbc_fetch_size  => 500
  lowercase_column_names => "false"
  schedule => "* * * * * *"
  last_run_metadata_path => "RunConfig\logpos\subscriber_last_run"
   statement_filepath => "\RunConfig\sql\subscriber.sql"
}

 }

Answer 1

您可以使用两个单独的文件配置来定义两个管道:每个管道将仅从一个输入JDBC中获取，并插入已定义的索引中:在这种情况下，您将需要运行Logstash的两个实例。

否则，您也可以使用一个实例，使用if if else来路由首选索引中的数据:

output
{
   if [type] == "agencydetails"
   {
     elasticsearch
     {
        hosts => "localhost:9200"
        user => "xxx"
        password => "xxx"
        index => "agencydetails"    
     }
   }
   else
   {
      elasticsearch
      {
        hosts => "localhost:9200"
        user => "xxx"
        password => "xxx"
        index => "subscriberdetails"
      }
   }
}