Question

我正在sys.stdin过滤器中执行以下mutate/add_field转换：

logstash

mutate { add_field => { "[retrieved_sessionid_new]" => "%{[retrieved_sessionid][0]}" } add_field => { "[totalBytes]" => "%{[retrieved_sessionid_new][totalBytes]}" } }（当然还有stdout）中是这样的

elasticsearch

为什么"retrieved_sessionid" => [ [0] "{\"srcBytes\":\"376\",\"ElapsedTime\":\"0\",\"@version\":\"1\",\"@timestamp\":\"2018-11-29T13:31:11.944Z\",\"dstBytes\":\"450\",\"SessionID\":\"39680\",\"tags\":[\"bar\",\"foo\",\"traffic_event\"],\"totalBytes\":\"826\"}" ] "retrieved_sessionid_new" => "{\"srcBytes\":\"537\",\"ElapsedTime\":\"8\",\"@version\":\"1\",\"@timestamp\":\"2018-11-29T13:31:03.931Z\",\"dstBytes\":\"526\",\"SessionID\":\"6131\",\"tags\":[\"bar\",\"boo\",\"traffic_event\"],\"totalBytes\":\"1063\"}", "totalBytes" => "%{[retrieved_sessionid_new][totalBytes]}",变量未正确插值？

修改：

原始totalBytes事件：

json

Answer 1

您应该将数据解码为JSON。

使用json过滤器的示例（已通过LS 6.5.1测试）：

input {
  stdin { }
}

filter {
  json {
    source => "message"
    add_field => { "[totalBytes]" => "%{[retrieved_sessionid][0][totalBytes]}" }
  }
}

output {
  stdout {}
}

输出：

{
                "message" => "{\"retrieved_sessionid\": [{\"srcBytes\":\"376\",\"ElapsedTime\":\"0\",\"@version\":\"1\",\"@timestamp\":\"2018-11-29T13:31:11.944Z\",\"dstBytes\":\"450\",\"SessionID\":\"39680\",\"tags\":[\"bar\",\"foo\",\"traffic_event\"],\"totalBytes\":\"826\"}]}",
             "@timestamp" => 2018-08-24T14:08:32.080Z,
    "retrieved_sessionid" => [
        [0] {
              "SessionID" => "39680",
             "@timestamp" => "2018-11-29T13:31:11.944Z",
            "ElapsedTime" => "0",
                   "tags" => [
                [0] "bar",
                [1] "foo",
                [2] "traffic_event"
            ],
               "dstBytes" => "450",
               "@version" => "1",
               "srcBytes" => "376",
             "totalBytes" => "826"
        }
    ],
                   "host" => "localhost.localdomain",
               "@version" => "1",
             "totalBytes" => "826"
}

Logstash过滤器不替换变量

1 个答案: