Question

我使用logstash，elasticsearch和kibana来收集日志。日志文件是json，如下所示：

{"_id":{"$oid":"5540afc2cec7c68fc1248d78"},"agentId":"0000000BAB39A520","handler":"SUSIControl","sensorId":"/GPIO/GPIO00/Level","ts":{"$date":"2015-04-29T09:00:00.846Z"},"vHour":1}
{"_id":{"$oid":"5540afc2cec7c68fc1248d79"},"agentId":"0000000BAB39A520","handler":"SUSIControl","sensorId":"/GPIO/GPIO00/Dir","ts":{"$date":"2015-04-29T09:00:00.846Z"},"vHour":0}

以及我在logstash中使用的代码：

input {
  file {
    type => "log"
    path => ["/home/data/1/1.json"]        
    start_position => "beginning"
  }
}

filter {
    json{
        source => "message"   
     }
}
output {
  elasticsearch { embedded => true }
  stdout { codec => rubydebug }
}

然后elasticsearch中的输出是：

{
"_index": "logstash-2015.06.29",
"_type": "log",
"_id": "AU5AG7KahwyA2bfnpJO0",
"_version": 1,
"_score": 1,
"_source": {
"message": "{"_id":{"$oid":"5540afc2cec7c68fc1248d7c"},"agentId":"0000000BAB39A520","handler":"SUSIControl","sensorId":"/GPIO/GPIO05/Dir","ts":{"$date":"2015-04-29T09:00:00.846Z"},"vHour":1}",
"@version": "1",
"@timestamp": "2015-06-29T16:17:03.040Z",
"type": "log",
"host": "song-Lenovo-IdeaPad",
"path": "/home/song/soft/data/1/Average.json",
"_id": {
"$oid": "5540afc2cec7c68fc1248d7c"
},
"agentId": "0000000BAB39A520",
"handler": "SUSIControl",
"sensorId": "/GPIO/GPIO05/Dir",
"ts": {
"$date": "2015-04-29T09:00:00.846Z"
},
"vHour": 1
}
}

但是json文件中的信息都在_source中没有索引所以我不能用kibana来分析它们。

kibana显示Analysis不适用于对象字段。 _source是对象字段

如何解决这个问题？

如何从Elasticsearch _source中提取要素以进行索引

0 个答案: