mirror of
https://github.com/elastic/logstash.git
synced 2025-04-24 14:47:19 -04:00
Fix for LOGSTASH-1634
This commit is contained in:
parent
3cb67f41ac
commit
45e6c89369
4 changed files with 11 additions and 8 deletions
|
@ -171,11 +171,11 @@
|
|||
superior search and analytics interface.
|
||||
- New feature: conditionals! You can now make "if this, then ..." decisions
|
||||
in your filters or outputs. See the docs here:
|
||||
https://logstash.net/docs/latest/configuration#conditionals
|
||||
http://logstash.net/docs/latest/configuration#conditionals
|
||||
- A new syntax exists for referencing fields (LOGSTASH-1153). This replaces
|
||||
the prior and undocumented syntax for field access (was 'foo.bar' and is
|
||||
now '[foo][bar]'). Learn more about this here:
|
||||
https://logstash.net/docs/latest/configuration#fieldreferences
|
||||
http://logstash.net/docs/latest/configuration#fieldreferences
|
||||
- A saner hash syntax in the logstash config is now supported. It uses the
|
||||
perl/ruby hash-rocket syntax: { "key" => "value", ... } (LOGSTASH-728)
|
||||
- ElasticSearch version 0.90.3 is included. (#486, Gang Chen)
|
||||
|
|
|
@ -142,10 +142,11 @@ By way of example, let us suppose we have this event:
|
|||
}
|
||||
}
|
||||
|
||||
The syntax to access fields is `[fieldname]`. If you are only referring to a
|
||||
top-level field, you can omit the `[]` and simply say `fieldname`. In the case
|
||||
of nested fields,
|
||||
like the "os" field above, you need the full path to that field: `[ua][os]`.
|
||||
- the syntax to access fields is `[fieldname]`.
|
||||
- if you are only referring to a **top-level field**, you can omit the `[]` and
|
||||
simply say `fieldname`.
|
||||
- in the case of **nested fields**, like the "os" field above, you need
|
||||
the full path to that field: `[ua][os]`.
|
||||
|
||||
## <a name="sprintf"></a>sprintf format
|
||||
|
||||
|
|
|
@ -78,6 +78,9 @@ class LogStash::Filters::Date < LogStash::Filters::Base
|
|||
# }
|
||||
# }
|
||||
#
|
||||
# If your field is dnested in your structure, you can use the nested
|
||||
# syntax [foo][bar] to match its value. For more information, please refer to
|
||||
# http://logstash.net/docs/latest/configuration#fieldreferences
|
||||
config :match, :validate => :array, :default => []
|
||||
|
||||
# Store the matching timestamp into the given target field. If not provided,
|
||||
|
|
|
@ -218,7 +218,7 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
|
|||
end
|
||||
end
|
||||
|
||||
describe "support deep field access" do
|
||||
describe "support deep nested field access" do
|
||||
config <<-CONFIG
|
||||
filter {
|
||||
date {
|
||||
|
@ -282,5 +282,4 @@ RUBY_ENGINE == "jruby" and describe LogStash::Filters::Date do
|
|||
insist { subject["@timestamp"].year } == Time.now.year
|
||||
end
|
||||
end
|
||||
|
||||
end
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue