Question

我在logstash中解析此日志。该日志包含嵌套的json。

[root@localhost conf.d]# cat dummy.txt
{"dwo":"0","rs":{"$date":"2016-02-11T00:52:50.348Z"},"first":[{"timestamp":"2016-02-11T00:52:51Z","a":"abc","b":"243253456","c":"fdsfg444323fef"},{"timestamp":"2016-02-11T00:52:51Z","a":"xyz","b":"543q653q654","c":"fewdfsdf","d":"Thu Feb 11 2016 11:52:47 GMT 1100 (AUS Eastern Daylight Time)","e":"4235345"}],"bwv":"40","cp_tz":{"$date":"2016-02-11T11:52:50.000Z"}}

这是我的logstash配置

[root@localhost conf.d]# cat hadoop.conf
input {
    stdin {}
}

filter {
    json {
            source => message
    }
}

output {
    stdout { codec => rubydebug }
}

这就是我运行logstash的方式

[root@localhost conf.d]# /opt/logstash/bin/logstash -f /etc/logstash/conf.d/hadoop.conf
Logstash startup completed
{"dwo":"0","rs":{"$date":"2016-02-11T00:52:50.348Z"},"first":[{"timestamp":"2016-02-11T00:52:51Z","a":"abc","b":"243253456","c":"fdsfg444323fef"},{"timestamp":"2016-02-11T00:52:51Z","a":"xyz","b":"543q653q654","c":"fewdfsdf","d":"Thu Feb 11 2016 11:52:47 GMT 1100 (AUS Eastern Daylight Time)","e":"4235345"}],"bwv":"40","cp_tz":{"$date":"2016-02-11T11:52:50.000Z"}}
{
   "message" => "{\"dwo\":\"0\",\"rs\":{\"$date\":\"2016-02-11T00:52:50.348Z\"},\"first\":[{\"timestamp\":\"2016-02-11T00:52:51Z\",\"a\":\"abc\",\"b\":\"243253456\",\"c\":\"fdsfg444323fef\"},{\"timestamp\":\"2016-02-11T00:52:51Z\",\"a\":\"xyz\",\"b\":\"543q653q654\",\"c\":\"fewdfsdf\",\"d\":\"Thu Feb 11 2016 11:52:47 GMT 1100 (AUS Eastern Daylight Time)\",\"e\":\"4235345\"}],\"bwv\":\"40\",\"cp_tz\":{\"$date\":\"2016-02-11T11:52:50.000Z\"}}",
  "@version" => "1",
"@timestamp" => "2016-04-04T03:04:17.722Z",
      "host" => "localhost",
       "dwo" => "0",
        "rs" => {
    "$date" => "2016-02-11T00:52:50.348Z"
},
     "first" => [
    [0] {
        "timestamp" => "2016-02-11T00:52:51Z",
                "a" => "abc",
                "b" => "243253456",
                "c" => "fdsfg444323fef"
    },
    [1] {
        "timestamp" => "2016-02-11T00:52:51Z",
                "a" => "xyz",
                "b" => "543q653q654",
                "c" => "fewdfsdf",
                "d" => "Thu Feb 11 2016 11:52:47 GMT 1100 (AUS Eastern Daylight Time)",
                "e" => "4235345"
    }
],
       "bwv" => "40",
     "cp_tz" => {
    "$date" => "2016-02-11T11:52:50.000Z"
}
}

如果你看下面的图像，你会发现＆＃34;第一个＆＃34; json没有索引，因此无法搜索。这就是我的疑问。我无法解析嵌套的json。

!kibana]https://cdn.discourse.org/elastic/uploads/default/optimized/2X/e/e71d3a6734a6b49e3722b0b140d9ae77711ab73a_1_690x381.png

Answer 1

Arrays of objects are not (and will not be) supported in Kibana.

在logstash中解析嵌套的json

1 个答案: