我在下面添加了json文件,我正在尝试使用logstash conf文件从json数据生成字段。请建议我如何编写配置以在弹性搜索中创建单个字段。
enter code here
"count": 15,
"value": [
{
"_links": {
"self": {
"href": "hyperlink"
},
"web": {
"href": "hyperlink"
},
"pipeline.web": {
"href": "hyperlink"
},
"pipeline": {
"href": "hyperlink"
}
},
"pipeline": {
"url": "hyperlink",
"id": 90,
"revision": 4,
"name": "Name",
"folder": "\"
},
"state": "completed",
"result": "succeeded",
"createdDate": "2020-10-21T20:00:02.2490446Z",
"finishedDate": "2020-10-21T20:11:17.5898951Z",
"url": "hyperlink",
"id": 6254,
"name": "0.1.0-integration.1+47"
},
我的logstash配置是
input {
file {
type => "json"
start_position => "beginning"
path => "/home/dataflow/example.json"
sincedb_path => "/dev/null"
codec => multiline {
pattern => "^"
negate => false
what => "previous"
auto_flush_interval => 2
}
}
}
filter {
json {
source => "message"
}
}
它像单个行一样存储索引作为消息。
我的要求是一切都转换为字段
提前谢谢。