Question

我有一个带有嵌套JSON对象的JSON文件。我想通过Logstash将这个JSON文件索引到我的Elasticsearch中，但Elasticsearch并不支持嵌套的JSON（尚未）。有没有办法在python中将这些嵌套对象转换为简单的JSON，可以搜索？

我使用的JSON是由python脚本创建的，该脚本使用Nmap并确定网络上的主机。此时ports数组无法搜索，这是我项目的全部目的。这是因为JSON数组被索引为数据库中的一个字段而不是它们自己的JSON字段。

样品：

{
    "host": {
        "status": {
            "_state": "up",
            "_reason": "echo-reply",
            "_reason_ttl": "60"
        },
        "address": {
            "_addr": "xxx.xxx.xxx.xxx",
            "_addrtype": "ipv4"
        },
        "hostnames": {
            "hostname": {
                "_name": "xxxxxx.com",
                "_type": "PTR"
            }
        },
        "ports": {
            "extraports": {
                "extrareasons": {
                    "_reason": "no-responses",
                    "_count": "994"
                },
                "_state": "filtered",
                "_count": "994"
            },
            "port": [
                {
                    "state": {
                        "_state": "closed",
                        "_reason": "reset",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "_name": "ftp-data",
                        "_method": "table",
                        "_conf": "3"
                    },
                    "_protocol": "tcp",
                    "_portid": "20"
                },
                {
                    "state": {
                        "_state": "open",
                        "_reason": "syn-ack",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "cpe": "cpe:/a:vsftpd:vsftpd",
                        "_name": "ftp",
                        "_product": "vsftpd",
                        "_version": "2.0.8 or later",
                        "_hostname": "Welcome",
                        "_method": "probed",
                        "_conf": "10"
                    },
                    "_protocol": "tcp",
                    "_portid": "21"
                },
                {
                    "state": {
                        "_state": "open",
                        "_reason": "syn-ack",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "cpe": "cpe:/a:openbsd:openssh:5.3",
                        "_name": "ssh",
                        "_product": "OpenSSH",
                        "_version": "5.3",
                        "_extrainfo": "protocol 2.0",
                        "_method": "probed",
                        "_conf": "10"
                    },
                    "_protocol": "tcp",
                    "_portid": "22"
                },
                {
                    "state": {
                        "_state": "open",
                        "_reason": "syn-ack",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "cpe": "cpe:/a:apache:http_server:2.2.15",
                        "_name": "http",
                        "_product": "Apache httpd",
                        "_version": "2.2.15",
                        "_extrainfo": "(CentOS)",
                        "_method": "probed",
                        "_conf": "10"
                    },
                    "_protocol": "tcp",
                    "_portid": "80"
                },
                {
                    "state": {
                        "_state": "open",
                        "_reason": "syn-ack",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "cpe": "cpe:/a:apache:http_server:2.2.15",
                        "_name": "http",
                        "_product": "Apache httpd",
                        "_version": "2.2.15",
                        "_extrainfo": "(CentOS)",
                        "_tunnel": "ssl",
                        "_method": "probed",
                        "_conf": "10"
                    },
                    "_protocol": "tcp",
                    "_portid": "443"
                },
                {
                    "state": {
                        "_state": "open",
                        "_reason": "syn-ack",
                        "_reason_ttl": "60"
                    },
                    "service": {
                        "_name": "rsync",
                        "_extrainfo": "protocol version 31",
                        "_method": "probed",
                        "_conf": "10"
                    },
                    "_protocol": "tcp",
                    "_portid": "873"
                }
            ]
        },
        "times": {
            "_srtt": "1392",
            "_rttvar": "258",
            "_to": "50000"
        },
        "_starttime": "1527320392",
        "_endtime": "1527320668"
    }
}

Answer 1

不要在elasticsearch mapping
中使用嵌套关键字

你可以做的更好的方法是将整个json结构定义为映射

然后在elasticsearch中搜索，你可能会得到它。

在Python中将嵌套的JSON数组转换为简单的JSON

1 个答案: