Question

运行以下配置的生成结果将TestResult部分显示为数组。我试图摆脱该数组，以便将数据发送到Elasticsearch。

我有以下XML文件：

input {
    file {
        path => "/var/log/logstash/test3.xml"
    }
}
filter {
    multiline {
        pattern => "<tem:SubmitTestResult>"
        negate => "true"
        what => "previous"
    }

    if "multiline" in [tags] {
        mutate {
            gsub => ["message", "\n", ""]
        }

        mutate {
            replace => ["message", '<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>%{message}']
        }

        xml {
            source => "message"
            target => "SubmitTestResult"
        }

        mutate {
            remove_field => ["message", "@version", "host", "@timestamp", "path", "tags", "type"]
            remove_field => ["[SubmitTestResult][xmlns:tem]","[SubmitTestResult][xmlns:acs]","[SubmitTestResult][xmlns:acs1]"]
        }

        mutate {
             replace => [ "[SubmitTestResult][LabId]", "%{[SubmitTestResult][LabId]}" ]
             replace => [ "[SubmitTestResult][userId]", "%{[SubmitTestResult][userId]}" ]
        }

        mutate {
            replace => [ "[SubmitTestResult][TestResult][0][CreatedBy]", "%{[SubmitTestResult][TestResult][0][CreatedBy]}" ]
            replace => [ "[SubmitTestResult][TestResult][0][CreatedDate]", "%{[SubmitTestResult][TestResult][0][CreatedDate]}" ]
            replace => [ "[SubmitTestResult][TestResult][0][LastUpdatedBy]", "%{[SubmitTestResult][TestResult][0][LastUpdatedBy]}" ]
            replace => [ "[SubmitTestResult][TestResult][0][LastUpdatedDate]", "%{[SubmitTestResult][TestResult][0][LastUpdatedDate]}" ]
            replace => [ "[SubmitTestResult][TestResult][0][Capacity95FHigh]", "%{[SubmitTestResult][TestResult][0][Capacity95FHigh]}" ]
            replace => [ "[SubmitTestResult][TestResult][0][Capacity95FHigh_AHRI]", "%{[SubmitTestResult][TestResult][0][Capacity95FHigh_AHRI]}" ]
            replace => [ "[SubmitTestResult][TestResult][0][CondensateDisposal_AHRI]", "%{[SubmitTestResult][TestResult][0][CondensateDisposal_AHRI]}" ]
            replace => [ "[SubmitTestResult][TestResult][0][DegradationCoeffCool]", "%{[SubmitTestResult][TestResult][0][DegradationCoeffCool]}" ]
        }
    }
}
output {
    stdout {
        codec => "rubydebug"
    }
}

我正在使用此配置：

"SubmitTestResult" => {
             "LabId" => "123",
            "userId" => "123",
        "TestResult" => [
            [0] {
                              "CreatedBy" => "123",
                            "CreatedDate" => "123",
                          "LastUpdatedBy" => "123",
                        "LastUpdatedDate" => "123",
                        "Capacity95FHigh" => "123",
                   "Capacity95FHigh_AHRI" => "123",
                "CondensateDisposal_AHRI" => "123",
                   "DegradationCoeffCool" => "123"
            }
        ]
    }

结果是：

TestResult

如您所见，jQuery()中有“[0]”数组。是否有一些配置更改我可以做以确保它不是作为一个数组出来？我想将此发送给Elasticsearch并希望数据正确。

Answer 1

我想出来了。在最后一个mutate块之后，我又添加了一个mutate块。我所要做的就是重命名这个领域，这就是诀窍。

mutate {
    rename => {"[SubmitTestResult][TestResult][0]" => "[SubmitTestResult][TestResult]"}
}

结果现在看起来很合适：

"SubmitTestResult" => {
         "LabId" => "123",
        "userId" => "123",
    "TestResult" => {
                      "CreatedBy" => "123",
                    "CreatedDate" => "123",
                  "LastUpdatedBy" => "123",
                "LastUpdatedDate" => "123",
                "Capacity95FHigh" => "123",
           "Capacity95FHigh_AHRI" => "123",
        "CondensateDisposal_AHRI" => "123",
           "DegradationCoeffCool" => "123"
    }
}

Logstash：TestResult以数组形式出现

1 个答案: