Question

我从RabbitMQ收到以下消息，我认为从RabbitMQ收到的JSON有BOM

{"ID":"811b7858-a926-479f-939a-2b0ab17de855","Name":"Johnson","Age": "30", "Work":"Engineer","Timestamp":"4/13/2015 10:53:29 AM"}

当我将其保存到弹性搜索中时，我得到如下所示：

{
"_index": "logstash-2015.04.13",
"_type": "logs",
"_id": "AUyxO4R8g98unoWRM4eU",
"_version": 1,
"_score": 1,
"_source": {
    "message": "{"ID":"811b7858-a926-479f-939a-2b0ab17de855",","Name":"Johnson","Age": "30", "Work":"Engineer","Timestamp":"4/13/2015 10:53:29 AM"}",
    "@version": "1",
    "@timestamp": "2015-04-13T05:23:29.935Z",
    "type": "Employees"
    }
}

但我希望将它们存储为

{
"_index": "logstash-2015.04.13",
"_type": "logs",
"_id": "AUyxO4R8g98unoWRM4eU",
"_version": 1,
"_score": 1,
"_source": {
    "ID":"811b7858-a926-479f-939a-2b0ab17de855",
    "Name":"Johnson",
    "Age": "30",
    "Work":"Engineer",
    "Timestamp":"4/13/2015 10:53:29 AM"
    "@version": "1",
    "@timestamp": "2015-04-13T05:23:29.935Z",
    "type": "Employees" 
    }
}

我尝试过json滤镜。但它没有用。

Answer 1

您可以尝试使用 json 过滤器进行 logstash，它将消息字符串转换为 json 格式

filter {
  json {
    source => "message"
    remove_field => ["message"]
  }
}

从RabbitMQ解析Logstash JSON

1 个答案: