elasticsearch - 使用 logstash 从 kibana 中存在的其他索引中丰富新索引中的字段

Question

我正在使用logstash从具有索引名称的csv文件创建一个新索引 - “治疗”

另一个指标是 kibana 中已经存在的“参与度”以及其他领域。

参与指数和治疗指数都具有共同的“id”字段。

我能够构建一个 conf 文件来将治疗数据摄取到 kibana。当治疗和参与字段“id”匹配时，我想要一些想法/提示来添加参与索引中的字段。并将丰富的治疗文档发送到治疗索引。

先感谢您。

当前的conf文件-

input {
  file {
    path => "/home/data.csv"
    start_position => "beginning"
  }
}
filter {
  csv {
      separator => ","
      skip_header => "true"
      columns => ["user_id","DeviceSerialNumber"]
  }
 elasticsearch {
              hosts => "<>"
              index => "participation"
              query => "id:\"%{[id]}\"
#Fields to add from participation index to therapy              
                    fields => { 
                    "Month" => "Month",
                    "cost" => "cost" 
                   }
        }
}
output{
stdout {}
#output {
 #  elasticsearch {
  #   hosts => "<>"
   #  index => "therapy"
 # }
}

我收到错误。

[ERROR] 2021-09-20 03:24:22.599 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"{\", \"}\" at line 19, column 22 (byte 562) after filter {\n    elasticsearch {\n              hosts => \"<>"\n              index => \"data-affective-participation\"\n              query => \"user_id:\\\"%{[user_id]}\\\"\n              fields => { \n                    \"", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:391:in `block in converge_state'"]}

标签： elasticsearchindexinglogstashkibana