vim filebeat.yml,在processors中新增script
# ================================= Processors =================================
processors:
- add_host_metadata:
when.not.contains.tags: forwarded
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
- script:
lang: javascript
id: remove_ipv6
source: >
function process(event) {
var message = event.Get("host.ip")
for (var i=0; i<message.length; i++)
{
if(new RegExp(".*\..*\..*\..*").test(message[i]))
{
event.Put("host.ip",message[i])
break;
}
}
}