Logstash Array split为一个元素数组提供Nilclass

Question

我正在尝试通过filebeat->输入日志中的json数据; logstash到elasticsearch，但无论我尝试什么，我似乎都会得到NilClass错误。

数据样本：

{"student":[{"details":{"name":chirs,"lname":dave},"age":10,"grade":1.2,"id":"323"}],"id":"metric95"}

我的logstash配置是：

input {
    beats {
        port => "5044"
    }
}
filter {
json {
    source => "message"
  }
 split {
      field => "[student]"
    }
}
output {
elasticsearch {
        hosts => [ "localhost:9200" ]
    }

    stdout { codec => rubydebug }
} 

Error:  split - Only String and Array types are splittable. field:[student] is of type = NilClass

Answer 1

请尝试

split {
  field => "student"
}

并用双引号{"name":"chirs","lname":"dave"}