logstash - 如何从消息字段中删除尾随换行符

Question

我正在将带有 Logstash 的 Glassfish 4 日志文件发送到 ElasticSearch 接收器。如何使用 Logstash 从消息字段中删除结尾的换行符？

我的事件是这样的:

{
  "@timestamp" => "2013-11-21T13:29:33.081Z",
  "message" => "[2013-11-21T13:29:32.577+0000] [glassfish 4.0] [INFO] [] [javax.resourceadapter.mqjmsra.lifecycle] [tid: _ThreadID=142 _ThreadName=Thread-43] [timeMillis: 1385040572577] [levelValue: 800] [[\n  MQJMSRA_RA1101: GlassFish MQ JMS Resource Adapter stopped.]]\n",
  "@version" => "1",
  "tags" => ["multiline", "date_filtered"],
  "host" => "myhost",
  "path" => "../server.log"
} 

Answer 1

第二种解决方案是使用 mutate filter of Logstash .它允许您去除字段的值。

filter {
  # Remove leading and trailing whitspaces (including newline etc. etc.)
  mutate {
    strip => "message"
  }
}