将值转换为Json后添加add_field logstash

Question

我的日志文件包含此格式的日志

"{\"user_id\":\"79\",\"timestamp\":\"2016-12-28T11:10:26Z\"‌​,\"operation\":\"ver‌​3 - Requested for recommended,verified handle information\",\"data\":\"\",\"content_id\":\"\",\"channel_id‌​\":\"\"}"

我写了logstash配置

input {
beats {
    port => "5043"
}
}
filter{
    grok {
       match => { "message" => "%{QS:mydata}"}
    }
    json {
       source => "message"
       target => "parsedJson"
    }
    mutate {
       add_field =>{
        "user_id" => "%{[parsedJson.user_id]}"
        "operation" => "%{[parsedJson][operation]}"
        "data"=> "%{[parsedJson][operation]}"
       }
     }
}
output {
    elasticsearch {
       hosts => [ "localhost:9200" ]
    }
}

基本上我已经尝试了许多排列来获取值，但是在elasticsearch数据中如下图所示。我无法从JSON获取数据并分配给新值。 请帮忙。

Answer 1

如果您尝试在add_field过滤器中加入json并在mydata中将source作为json，该怎么办？另外，请确保不要将add_field值与.点分开：

json {
     source => "mydata"
     target => "parsedJson"
     add_field => {
      "user_id" => "%{[parsedJson][user_id]}}"
      "operation" => "%{[parsedJson][operation]}}"
      "data" => "%{[parsedJson][data]}}"
     }
     remove_field=>["mydata"] <-- you can ignore this if you really don't want to remove
}

希望它有所帮助！