用于提取逗号分隔消息的ksql语句是其自己的字段

Question

我有一个字段较少的JSON对象。

{
"@timestamp": "2019-01-14T14:34:47.617Z",
"message": "20190114T063447-0800,dm-2,SSD2T-backarea,1.99,0.00,0.00,0.00,0.00,0.00,0.00,0.00,0.00,0.00,0.00,0.00,0.00,0.00",
"node": "hostnameA",
}

将message字段剖析为正确的方法是拥有自己的字段并保留node和@timestamp。

Answer 1

我认为这不可能。您将寻找某种SPLIT函数，该函数目前尚不存在。我已将其记录为建议的增强功能here。

您的数据来自哪里？您是否可以选择将message字段获取为结构化JSON？还是整个有效负载都以逗号分隔？