logstashを使ってTOOKフィールドが15msを超えるslowlogを取得していますか？

Question

LOGS：

[2017-01-14 10:48:06,848][WARN ][index.search.slowlog.query] [yaswanth] [bank][0] took[27.8ms], took_millis[27], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[5], source[], extra_source[], 
[2017-01-14 10:48:06,851][WARN ][index.search.slowlog.query] [yaswanth] [bank][3] took[12.7ms], took_millis[33], types[], stats[], search_type[QUERY_THEN_FETCH], total_shards[5], source[], extra_source[], 

私は、その場を取った> 15msのあるログを取得しようとしています。私は、以下の設定に

input { 
    file { 
    path => "F:\logstash-2.4.0\logstash-2.4.0\pica.txt" 
    start_position => "beginning" 
    } 
} 

filter { 
      grok { 
       match => [ "message", "\[%{TIMESTAMP_ISO8601:TIMESTAMP}\]\[%{LOGLEVEL:LEVEL}%{SPACE}\]\[%{DATA:QUERY}\]%{SPACE}\[%{DATA:QUERY1}\]%{SPACE}\[%{DATA:INDEX-NAME}\]\[%{DATA:SHARD}\]%{SPACE}took\[%{DATA:TOOK}\],%{SPACE}took_millis\[%{DATA:TOOKM}\], types\[%{DATA:types}\], stats\[%{DATA:stats}\], search_type\[%{DATA:search_type}\], total_shards\[%{NUMBER:total_shards}\], source\[%{DATA:source_query}\], extra_source\[%{DATA:extra_source}\],"] 
      } 
if [TOOK] > 15ms { 
    mutate { 
     add_tag => "slowresponse" 
    } 
    } else { 
    drop { } 
    } 
} 
output { 
stdout { codec => rubydebug } 

} 

を使用し、エラーがこのようなものです：

[31mException in pipelineworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash. {"exception"=>#<NoMethodError: undefined method `>' for nil:NilClass>, "backtrace"=>["(eval):123:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):121:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):91:in `filter_func'", "F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:267:in `filter_batch'", "org/jruby/RubyArray.java:1613:in `each'", "org/jruby/RubyEnumerable.java:852:in `inject'", "F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:265:in `filter_batch'", "F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:223:in `worker_loop'", "F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:201:in `start_workers'"], :level=>:error}[0m 
NoMethodError: undefined method `>' for nil:NilClass 
    initialize at (eval):123 
      each at org/jruby/RubyArray.java:1613 
    initialize at (eval):121 
      call at org/jruby/RubyProc.java:281 
    filter_func at (eval):91 
    filter_batch at F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:267 
      each at org/jruby/RubyArray.java:1613 
     inject at org/jruby/RubyEnumerable.java:852 
    filter_batch at F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:265 
    worker_loop at F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:223 
    start_workers at F:/logstash-2.4.0/logstash-2.4.0/vendor/bundle/jruby/1.9/gems/logstash-core-2.4.0-java/lib/logstash/pipeline.rb:201 

私は15msのより大きなフィールドを取ったされているログを見てみたいです。私は"15ms"を与えることによってそれを試みた。

THANKS

Answer 1

私はそれは、文字列1より比較しやすい数値が含まれているので、代わりにTOOKフィールドのTOOKMフィールドを使用することをお勧めします。また、を使用してTOOKMを整数に変換する必要があります。あなたが欲しいものを達成するのに役立ちます

変更された構成はここにある：

input { 
    file { 
    path => "F:\logstash-2.4.0\logstash-2.4.0\pica.txt" 
    start_position => "beginning" 
    } 
} 

filter { 
    grok { 
     match => [ "message", "\[%{TIMESTAMP_ISO8601:TIMESTAMP}\]\[%{LOGLEVEL:LEVEL}%{SPACE}\]\[%{DATA:QUERY}\]%{SPACE}\[%{DATA:QUERY1}\]%{SPACE}\[%{DATA:INDEX-NAME}\]\[%{DATA:SHARD}\]%{SPACE}took\[%{DATA:TOOK}\],%{SPACE}took_millis\[%{DATA:TOOKM}\], types\[%{DATA:types}\], stats\[%{DATA:stats}\], search_type\[%{DATA:search_type}\], total_shards\[%{NUMBER:total_shards}\], source\[%{DATA:source_query}\], extra_source\[%{DATA:extra_source}\],"] 
    } 

    # ==> add this filter to convert TOOKM to integer 
    mutate { 
     convert => { "TOOKM" => "integer" } 
    } 

    # ==> use TOOKM field instead 
    if [TOOKM] > 15 { 
     mutate { 
      add_tag => "slowresponse" 
     } 
    } else { 
     drop { } 
    } 
} 
output { 
    stdout { codec => rubydebug } 
}