无法在logstash输出中执行脚本

Question

我想通过logstash从elasticsearch中删除特定字段但是当我运行conf文件时出现错误

输出：-

output{
elasticsearch {
          hosts => ["http://localhost:9200"]
          index => "test"
          action => "update"
          ilm_enabled => "true"
          document_id => "%{fingerprint}"
          script_lang => "painless"
          script_type => ["inline"]
          script =>"
            Set keys = new HashSet(ctx._source.keySet());
             for(i in keys){
               if (i.incudes?('mobile')
               {
                    ctx._source.remove(i);
                } 
               }
          "
        }
  }

错误：-

[2020-03-13T17:25:20,704][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["update", {:_id=>"20cb05210d53aa8a6bfb4e354408355358676a3398723aaac1bbc9fabb966bf8", :_index=>"test", :_type=>"_doc", :routing=>nil, :retry_on_conflict=>1}, #<LogStash::Event:0x359a0ae9>], :response=>{"update"=>{"_index"=>"test", "_type"=>"_doc", "_id"=>"20cb05210d53aa8a6bfb4e354408355358676a3398723aaac1bbc9fabb966bf8", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to execute script", "caused_by"=>{"type"=>"script_exception", "reason"=>"compile error", "script_stack"=>["... mobile')\r\n               {\r\n                    ct ...", "                             ^---- HERE"], "script"=>"\r\n            Set keys = new HashSet(ctx._source.keySet());\r\n             for(i in keys){\r\n               if (i.incudes?('mobile')\r\n               {\r\n                    ctx._source.remove('padd');\r\n                } \r\n               }\r\n          ", "lang"=>"painless", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"unexpected token ['{'] was expecting one of [':']."}}}}}}

Answer 1

错误不存在。如您的日志中所写：

[2020-03-13T17:25:20,704][WARN ][logstash.outputs.elasticsearch][main] Could not index event to Elasticsearch. {:status=>400, :action=>["update", {:_id=>"20cb05210d53aa8a6bfb4e354408355358676a3398723aaac1bbc9fabb966bf8", :_index=>"test", :_type=>"_doc", :routing=>nil, :retry_on_conflict=>1}, #<LogStash::Event:0x359a0ae9>], :response=>{"update"=>{"_index"=>"test", "_type"=>"_doc", "_id"=>"20cb05210d53aa8a6bfb4e354408355358676a3398723aaac1bbc9fabb966bf8", "status"=>400, 

"error"=>{"type"=>"illegal_argument_exception", "reason"=>"failed to execute script", "caused_by"=>{"type"=>"script_exception", "reason"=>"compile error", "script_stack"=>["... mobile')\r\n               {\r\n                    ct ...", "                             ^---- HERE"], "script"=>"\r\n            Set keys = new HashSet(ctx._source.keySet());\r\n             for(i in keys){\r\n               if (i.incudes?('mobile')\r\n               {\r\n                    ctx._source.remove('padd');\r\n                } \r\n               }\r\n          ", "lang"=>"painless", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"unexpected token ['{'] was expecting one of [':']."}}}}}}

您应该在此堆栈中括住括号：
"... mobile')\r\n
               {
\r\n                    ct ...", "                             ^---- HERE"], "script"=>"
\r\n            Set keys = new HashSet(ctx._source.keySet());\r\n

该代码似乎与您发布的代码有些不同