如果不配置，分词是默认的，需要使用自定义模板功能来设置分词。

查看 Logstash 默认模板

  1. GET     /_template/logstash

创建模板 /sync/logstash-ik.json

“analyzer”: “ik_max_word”, 添加分词器

  1. {
  2.     "order": 0,
  3.     "version": 1,
  4.     "index_patterns": ["*"],
  5.     "settings": {
  6.         "index": {
  7.             "refresh_interval": "5s"
  8.         }
  9.     },
  10.     "mappings": {
  11.         "_default_": {
  12.             "dynamic_templates": [
  13.                 {
  14.                     "message_field": {
  15.                         "path_match": "message",
  16.                         "match_mapping_type": "string",
  17.                         "mapping": {
  18.                             "type": "text",
  19.                             "norms": false
  20.                         }
  21.                     }
  22.                 },
  23.                 {
  24.                     "string_fields": {
  25.                         "match": "*",
  26.                         "match_mapping_type": "string",
  27.                         "mapping": {
  28.                             "type": "text",
  29.                             "norms": false,
  30.                             "analyzer": "ik_max_word",
  31.                             "fields": {
  32.                                 "keyword": {
  33.                                     "type": "keyword",
  34.                                     "ignore_above": 256
  35.                                 }
  36.                             }
  37.                         }
  38.                     }
  39.                 }
  40.             ],
  41.             "properties": {
  42.                 "@timestamp": {
  43.                     "type": "date"
  44.                 },
  45.                 "@version": {
  46.                     "type": "keyword"
  47.                 },
  48.                 "geoip": {
  49.                     "dynamic": true,
  50.                     "properties": {
  51.                         "ip": {
  52.                             "type": "ip"
  53.                         },
  54.                         "location": {
  55.                             "type": "geo_point"
  56.                         },
  57.                         "latitude": {
  58.                             "type": "half_float"
  59.                         },
  60.                         "longitude": {
  61.                             "type": "half_float"
  62.                         }
  63.                     }
  64.                 }
  65.             }
  66.         }
  67.     },
  68.     "aliases": {}
  69. }

配置文件增加配置

# 定义模板名称
template_name => "myik"
# 模板所在位置
template => "/usr/local/logstash-6.4.3/sync/logstash-ik.json"
# 重写模板
template_overwrite => true
# 默认为true，false关闭logstash自动管理模板功能，如果自定义模板，则设置为false
manage_template => false

重新运行 Logstash

./logstash -f /usr/local/logstash-6.4.3/sync/logstash.conf