Logstash将单个哈希类型拆分为多个文档

时间:2017-02-10 17:09:36

标签: elasticsearch logstash

我打算建立自己的Elasticsearch监控集群。通过Elasticsearch源的查询指标和统计信息,并写入Elasticsearch监控集群。

但是当我用" GET / _nodes / stats"查询时,我得到这样的哈希结果。

{"nodes":{ 
  "W4x_8xNSSquKqR8YxUZLrw": { 
      "timestamp": 1486692663526,
      "name": "myserver1",
      ...
  }, 
  "W4x_8xNSSquKqR8YxUZLra" :{
      "timestamp": 1486693663526,
      "name": "myserver2",
      ...
  },
  "W4x_8xNSSquKqR8YxUZaaa" :{
      "timestamp": 1486693633326,
      "name": "myserver3",
      ...
  }
}}

如何使用Logstash将此文档的结果拆分为3个文档?然后,将nodeId移动为类似的字段值。

{
      "nodeId": "W4x_8xNSSquKqR8YxUZLrw",
      "timestamp": 1486692663526,
      "name": "myserver1",
      ...
}
{
      "nodeId": "W4x_8xNSSquKqR8YxUZLra",
      "timestamp": 1486693663526,
      "name": "myserver2",
      ...
}
{
      "nodeId": "W4x_8xNSSquKqR8YxUZaaa",
      "timestamp": 1486693633326,
      "name": "myserver3",
      ...
}

0 个答案:

没有答案