filter {
if [etltype] == "blocks" { #[fields][srctype]
csv {
columns => [
"number", "hash", "parent_hash", "nonce", "sha3_uncles", "logs_bloom", "transactions_root",
"state_root", "receipts_root", "miner", "difficulty", "total_difficulty", "size", "extra_data",
"gas_limit", "gas_used", "timestamp", "transaction_count"
]
separator => ","
remove_field => ["message"]
skip_empty_columns => true
skip_empty_rows => true
}
}else if [etltype] == "contracts" { #[fields][srctype]
csv {
columns => [
"address", "bytecode", "function_sighashes", "is_erc20", "is_erc721"
]
separator => ","
remove_field => ["message"]
skip_empty_columns => true
skip_empty_rows => true
}
}else if [etltype] == "logs" { #[fields][srctype]
csv {
columns => [
"log_index", "transaction_hash", "transaction_index", "block_hash", "block_number",
"address", "data", "topics"
]
separator => ","
remove_field => ["message"]
skip_empty_columns => true
skip_empty_rows => true
}
}else if [etltype] == "receipts" { #[fields][srctype]
csv {
columns => [
"transaction_hash", "transaction_index", "block_hash", "block_number", "cumulative_gas_used",
"gas_used", "contract_address", "root", "status"
]
separator => ","
remove_field => ["message"]
skip_empty_columns => true
skip_empty_rows => true
}
}else if [etltype] == "token_transfers" { #[fields][srctype]
csv {
columns => [
""
]
separator => ","
remove_field => ["message"]
skip_empty_columns => true
skip_empty_rows => true
}
}else if [etltype] == "tokens" { #[fields][srctype]
csv {
columns => [
""
]
separator => ","
remove_field => ["message"]
skip_empty_columns => true
skip_empty_rows => true
}
}else if [etltype] == "transactions" { #[fields][srctype]
csv {
columns => [
"hash", "nonce", "block_hash", "block_number", "transaction_index", "from_address",
"to_address", "value", "gas", "gas_price", "inputcontext"
]
separator => ","
remove_field => ["message"]
skip_empty_columns => true
skip_empty_rows => true
}
}
}
output {
if [etltype] == "blocks" {
elasticsearch {
hosts => "xxx.xxx.xxx.xxx:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-blocks-%{+YYYY.MM.dd}"
document_id => "%{[hash]}"
}
}else if [etltype] == "logs" {
elasticsearch {
hosts => "xxx.xxx.xxx.xxx:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-logs-%{+YYYY.MM.dd}"
}
}else if [etltype] == "transactions" {
elasticsearch {
hosts => "xxx.xxx.xxx.xxx:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-transactions-%{+YYYY.MM.dd}"
document_id => "%{[hash]}"
}
}else if [etltype] == "contracts" {
elasticsearch {
hosts => "xxx.xxx.xxx.xxx:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-contracts-%{+YYYY.MM.dd}"
document_id => "%{[address]}"
}
}else{
elasticsearch {
hosts => "xxx.xxx.xxx.xxx:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
stdout { codec => rubydebug }
}
transactions csv fileds are
hash,nonce,block_hash,block_number,transaction_index,from_address,to_address,value,gas,gas_price,
input
input
must change to other name like
inputcontext
like this:
hash,nonce,block_hash,block_number,transaction_index,from_address,to_address,value,gas,gas_price,
inputcontext
Fxxxx No change name can't import success, even logstash get correct. But this bug sometime use new docker-compose ELK can import success. So just change name more easy.
===============================
Error No Use
if [etltype] in ["blocks"]
Correct
if [etltype] == "blocks"
Only more then two args
if [etltype] in ["blocks", "transactions" ...]
This is ok
