From fa0231ccbd484a7b3f2f138d43d67b3c09f5e259 Mon Sep 17 00:00:00 2001
From: ycz008 <yangchengzi@seethingx.com>
Date: Wed, 27 Sep 2023 15:14:22 +0800
Subject: [PATCH] update logstash

---
 dev-upgrade/elastic/logstash.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/dev-upgrade/elastic/logstash.yml b/dev-upgrade/elastic/logstash.yml
index fe3d36f..0d95239 100644
--- a/dev-upgrade/elastic/logstash.yml
+++ b/dev-upgrade/elastic/logstash.yml
@@ -16,9 +16,8 @@ data:
           source => "message"
         }   
       }   
-      mutate {
-        split => { "log.file.path" => "/" }
-        add_field => { "env" => "%{[log.file.path][2]}" }
+      grok {
+        match => { "log.file.path" => "(?:/[^/]+){2}/(?<env>[^/]+)" }
       }
     }