Logstash - Memorize 插件的使用

尝试使用“记忆”插件，如下所示：

            if [message] =~ /matching event/ {

                grok {
                    match => [ "message", "%{mymatch:datetime}" ]
                }

                memorize {
                    field => [datetime]
                }
            }

            if [message] =~ /another event/ {
                mutate {
                    add_field => {
                        datetime => "%{datetime}"
                    }
                }
            }

正在添加名为 datetime 的字段，但它仅包含文本“%{datetime}”。显然我错误地使用了该插件。有人可以建议如何引用记忆值吗？

Thanks.

该插件的工作方式如下：

        if [message] =~ /matching event/ {
            grok {
                match => [ "message", "%{mymatch:datetime}" ]
            }
        }
        # either save the datetime or add it based on last value
        memorize {
           field => 'datetime'
           default => '00:00:00'
        }

        if [message] =~ /another event/ {
            # datetime has already been added based on the above line
        }