我在Logstash中遇到了关于JSON的问题。 我有一个看起来像这样的JSON输入:
{
"2": {
"name": "name2",
"state": "state2"
},
"1": {
"name": "name1",
"state": "state1"
},
"0": {
"name": "name0",
"state": "state0"
}
}
现在,让我们说我想在logstash配置中添加一个字段
json{
source => "message"
add_field => {
"NAME" => "%{ What to write here ?}"
"STATE" => "%{ What to write here ?}"
}
}
有没有办法访问JSON输入,这样我得到一个名为name1的字段名,另一个名为2的字段和一个名为3的第三个字段.JSON中的第一个键正在改变,这意味着只能是一个或多个部分。所以我不想像
那样硬编码%{[0][name]}
感谢您的帮助。
答案 0 :(得分:2)
If you remove all new lines in your input you can simply use the json filter. You don't need any add_field
action.
Working config without new lines:
filter {
json { source => message }
}
If you can't remove the new lines in your input you need to merge the lines with the multiline codec.
Working config with new lines:
input {
file {
path => ["/path/to/your/file"] # I suppose your input is a file.
start_position => "beginning"
sincedb_path => "/dev/null" # just for testing
codec => multiline {
pattern => "^}"
what => "previous"
negate => "true"
}
}
}
filter {
mutate { replace => { "message" => "%{message}}" } }
json { source => message }
}
I suppose that you use the file input. In case you don't, just change it.
Output (for both):
"2" => {
"name" => "name2",
"state" => "state2"
},
"1" => {
"name" => "name1",
"state" => "state1"
},
"0" => {
"name" => "name0",
"state" => "state0"
}