Question

我正在尝试使用logstash解析以下json

   {
    "payload": "{\"class\":\"OpenLoyalty\\\\Component\\\\Account\\\\Domain\\\\Event\\\\PointsTransferHasBeenExpired\",\"payload\":{\"accountId\":\"1cbd42b8-1b1f-4a13-a28f-eefeb73a64b0\",\"pointsTransferId\":\"e82c96cf-32a3-43bd-9034-4df343e5f111\"}}"
}

使用此过滤器：

    input {
        jdbc {
            jdbc_connection_string => "jdbc:postgresql://localhost:5432/openloyalty"
            jdbc_user => "openloyalty"
            jdbc_password => "openloyalty"
            jdbc_driver_library => "C:\logstash\postgresql-42.2.12.jar"
            jdbc_driver_class => "org.postgresql.Driver"
            statement => "SELECT payload from events where events.id=130;"
        }
    }
    filter {
          json {
            source => "payload"
            remove_field => ["class"]
          }

    }
    output {
        stdout { codec => json_lines }
    }

我得到以下输出：

    {
    "@version": "1",
    "@timestamp": "2020-05-12T11:27:15.097Z",
    "payload": {
        "accountId": "1cbd42b8-1b1f-4a13-a28f-eefeb73a64b0",
        "pointsTransferId": "e82c96cf-32a3-43bd-9034-4df343e5f111"
    }
   }

但是，我正在寻找的是这样的

{
"@version": "1",
"@timestamp": "2020-05-12T11:27:15.097Z",
 {
    "accountId": "1cbd42b8-1b1f-4a13-a28f-eefeb73a64b0",
    "pointsTransferId": "e82c96cf-32a3-43bd-9034-4df343e5f111"
 }
}

如何从我的Json对象中删除“有效载荷”名称？

Answer 1

在mutate过滤器之后，可以将json过滤器与以下配置一起使用。

mutate {
    rename => {
        "[payload][accountId]" => "accountId"
        "[payload][pointsTransferId]" => "pointsTransferId"
    }
    remove_field => ["[payload]"]
}

这将重命名您的字段，并在重命名后删除空的payload json对象。

使用Logtash删除Json对象名称

1 个答案: