Logstash“变异-无法将“ false”转换为布尔值。”

Question

我目前正在从API中提取Logstash（7.8.1）配置中的json，然后对其进行过滤，然后将其输出到Elasticsearch。对于初学者来说，对我的API的简单curl调用将输出以下我试图在logstash配置文件的过滤器部分中清除的json：

{
"numRowsToRead": "5000",
  "cosmosDocCount": "\"5000\"",
  "totalFragmentCount": 5000,
  "lastSuccessfulBatchTimestamp": "\"null\"",
  "streamingDriven": "\"false\"",
  "totalRows": "5000",
  "lastBatchId": "\"null\"",
  "status": "TASK_FINISHED",
  "samplingRatio": 1.0,
  "mergeStrategy": "timestampOrdered_pdg",
  "lastSampledTimestamp": "2020-07-31 19:45:03.0"
}

我在这里遇到的问题是在streamingDriven属性上，因为我希望它的类型为 boolean 而不是 string ，因此我更新了使用以下内容过滤配置：

mutate{
    gsub => ["streamingDriven","\"",""]
    convert      => {
                    "streamingDriven" => "boolean"
                    "totalRows" => "integer"
                    "numRowsToRead" => "integer"
                    "cosmosDocCount" => "integer"
                    }
    remove_field => ["@version", "http_poller_metadata"]
}

由于某些未知原因，streamingDriven仍然是 string ，我看到了日志输出：

[WARN ] 2020-08-10 19:59:52.612 [[main]>worker1] mutate - Failed to convert "false" into boolean.
{
                 "streamingDriven" => "false",
                  "cosmosDocCount" => 0,
                   "numRowsToRead" => 5000,
    "lastSuccessfulBatchTimestamp" => "\"null\"",
                     "lastBatchId" => "\"null\"",
                   "mergeStrategy" => "timestampOrdered_pdg",
              "totalFragmentCount" => 5000,
                          "status" => "TASK_FINISHED",
                       "totalRows" => 5000,
                   "samplingRatio" => 1.0,
            "lastSampledTimestamp" => "2020-07-31 19:45:03.0",
                      "@timestamp" => 2020-08-01T02:45:03.000Z
}

documentation似乎表明"streamingDriven" => "boolean"应该将boolean类型的“ false”转换为false，而我试图弄清楚为什么它对我不起作用。有什么想法我做错了吗？

Answer 1

我想出了需要做些什么才能使它工作。诀窍是像这样使用第二个变异：

mutate{
        add_field => {
            streaming_driven => "%{streamingDriven}"
        }
        gsub => ["streamingDriven","\"",""]
}
mutate{
    convert => {
        "streaming_driven" => "boolean"
    }
    remove_field => ["@version", "http_poller_metadata"]
}

现在我得到一个布尔值。