Logstash嵌套对象中的嵌套对象

时间:2019-02-20 13:57:55

标签: arrays elasticsearch nested logstash

我想在嵌套对象中添加嵌套对象。 这是我的logstash conf:

filter{
    mutate {
         add_field => { "taskId" => "bx-%{box_id}" }
        }
    aggregate {
            task_id => "%{taskId}"
            code => "
                map['box_posts'] ||= []
                map['post_media'] ||= []
                map['box_posts'] << {'post_box_id' => event.get('post_box_id'), 
                'score' => event.get('score'),
                'box_id' => event.get('box_id'),
                'user_id' => event.get('id'),
                'post_media' => [{'file_width'=> event.get('file_width'),
                          'notification_file_width'=> event.get('notification_file_width'),
                        'thumb_file_height'=> event.get('thumb_file_height'),
                        'home_file_height'=> event.get('home_file_height'),
                        'notification_file_height'=> event.get('notification_file_height'),
                        'thumb_file_width'=> event.get('thumb_file_width'),
                        'collage_file_width'=> event.get('collage_file_width'),
                        'medium_file_height'=> event.get('medium_file_height'),
                        'home_file_width'=> event.get('home_file_width'),
                        'collage_file_height'=> event.get('collage_file_height'),
                        'md5_filename'=> event.get('md5_filename'),
                        'bucket'=> event.get('bucket'),
                        'bg_color'=> event.get('bg_color'),
                        'file'=> event.get('file'),
                        'file_base_name'=> event.get('file_base_name'),
                        'file_type'=> event.get('file_type'),
                        'file_height'=> event.get('file_height'),
                        'file_type_number'=> event.get('file_type_number'),
                        'medium_file_width'=> event.get('medium_file_width')
                    }]
                }   
            "   
            push_previous_map_as_event => true
            timeout => 5
         }
    mutate {
        remove_field => [ "[@timestamp]" , "[@version]"]
    }
}

它只是在post_media中添加了1条记录,但我想要的是post_media的数组,而不仅仅是其中的1个对象。

0 个答案:

没有答案