Logstash将对象数组转换为术语数组

Question

编辑 - ＆gt;我为此创建了一个插件，可以在这里找到：

• https://rubygems.org/gems/logstash-filter-collect
• https://github.com/mikebski/logstash-filter-collect

您可以使用bin/logstash-plugin install logstash-filter-collect进行安装 我有一个logstash条目，如：

 "cvals" => [
            [0] {
                   "text" => "cval something 1",
                "indices" => [
                    [0] 17,
                    [1] 29
                ]
            },
            [1] {
                   "text" => "cval something else 2",
                "indices" => [
                    [0] 17,
                    [1] 29
                ]
            }
            ...
            [n] {
                "text" => "cval more stuff n",
                "indices" => [
                    [0] 17,
                    [1] 29
                ]
            }

        ]

我想将其改为：

"cvals_terms" => [ "cval something 1", "cval something else 2", ..., "cval more stuff n"]

如何使用Logstash执行此操作？我可以用一块Ruby代码做到这一点，但必须有一种方法可以用mutate或者我认为的东西来做...

Answer 1

使用logstash-oss v6.3.0，应能进行以下操作：

filter {
  ruby {
    code => "event.set('cvals_terms', event.get('cvals').map{ |n| n['text'] })"
  }
}

缺点是您使用字符串编码，从长远来看会损害可维护性。