"level" => {
"levelStr" => "ERROR",
"level" => 40000
},
"type" => "community",一、用某个字段作为过滤条件
filter {
if [type] != "community"{
drop {}
}
}二、用某个二级字段作为过滤条件
filter {
if [level][levelStr] != "ERROR"{
drop {}
}
}参考：
https://discuss.elastic.co/t/how-to-refer-to-subfield-in-logstash/79474
原文：http://blog.51cto.com/4988084/2118214