logstash 问题

filter模块

split后join不生效问题

filter {
    mutate {
      split => ["url", "?"]
      add_field => ["request_url", "%{url[0]}"]
      split => ["date", "T"]
      add_field => ["current_date", "%{date[0]}"]
      remove_field => ['date']
      join => { "url" => "?" }

    }
}