常用操作
常用操作
filter {
mutate {
rename => { "host" => "hostname" }
add_field => { "env" => "prod" }
convert => { "status" => "integer" }
gsub => [ "path", "/[0-9]+", "/{id}" ]
remove_field => ["agent", "ecs"]
}
}把动态路径替换成稳定模板（如 /order/{id}）能显著降低聚合维度爆炸。