Question

我们希望使用JSON数组格式的logstash的http插件来实现服务请求跟踪。

尝试解析JSON数组时，我们收到以下错误：

错误：

:message=>"gsub mutation is only applicable for Strings, skipping", :field=>"message", :value=>nil, :level=>:debug, :file=>"logstash/filters/mutate.rb", :line=>"322", :method=>"gsub"}
:message=>"Exception in filterworker", "exception"=>#<LogStash::ConfigurationError: Only String and Array types are splittable. field:message is of type = NilClass>

我的json数组是：

{
    "data": [
        {
            "appName": "DemoApp",
            "appVersion": "1.1",
            "deviceId": "1234567",
            "deviceName": "moto e",
            "deviceOSVersion": "5.1",
            "packageName": "com.DemoApp",
            "message": "testing null pointer exception",
            "errorLog": "null pointer exception"
        },
        {
            "appName": "DemoApp",
            "appVersion": "1.1",
            "deviceId": "1234567",
            "deviceName": "moto e",
            "deviceOSVersion": "5.1",
            "packageName": "com.DemoApp",
            "message": "testing illegal state exception",
            "errorLog": "illegal state exception"
        }
    ]
}

我的logstash配置是：

    input {
            http {
            codec => "plain"
            }
    }
    filter{
            json {
                  source => "message"
                 }
            mutate { gsub => [ "message", "},", "shr" ] }
            split {
                  terminator => "shr"
                  field => "data"
           }
    }
    }


output {
 stdout { codec => "json" }
    gelf{
        host => localhost
        facility => "%{type}"
        level =>["%{SeverityLevel}", "INFO"]
        codec => "json"
    }
       file{
        path => "/chroot/result.log"
}
}

任何帮助都将不胜感激。

Answer 1

Logstash有一个名为消息的默认元数据字段。所以你的json message字段重叠了。考虑将 json 字段名message更改为另一个。

另一个选项可能是使用target设置并引用目标字段，如：

json { source => "message" target => "data"}
mutate { gsub => [ "[data][message]", "\}\,\r\n\r\n\{", "\}shr\{" ] }

我希望这会有所帮助。

使用logstash的json数组解析问题

1 个答案: