如果处理器工作,为什么我的 filebeats 不工作?

问题描述 投票:0回答:1

这里的目标是检查一些条件并替换值。我正在为我的 filebeat 使用 if 处理器(与 elasticsearch 交互)

  - if:
      and:
        regexp:
          severity_for_condition: 1
          event_type_for_condition: "bat_vol"
    then:
      - add_fields:
          target: data.condition
          fields:
            data.condition: "Low voltage detected - critical"
    else:
      - add_fields:
          target: data.condition
          fields:
            data.condition: "Low voltage detected - warning"
  - if:
      and:
        regexp:
          severity_for_condition: 1
          event_title_for_condition: "GPS Power Loss"
    then:
      - add_fields:
          target: data.condition
          fields:
            data.condition: "GPS power loss detected"
    else:
      - add_fields:
          target: data.condition
          fields:
            data.condition: "Intermittent GPS power loss detected"

我遇到的错误是:

error initializing beat: error initializing processors: failed to make if/then/else processor: missing or invalid condition

缺失或无效的条件在哪里?我会补充说,这些值

regexp: 
来自文件中上面我的脚本:

 - script:
      lang: javascript
      source: >
        function process(event) {
          var severity_for_condition = event.Get("data.severity");
          var event_type_for_condition = event.Get("type");
          var event_title_for_condition = event.Get("data.title"); 

filebeat elastic-beats
1个回答
0
投票

目标需要报价:

target: ""
© www.soinside.com 2019 - 2024. All rights reserved.