gpt4 book ai didi

elasticsearch - Logstash 不解析 json

转载 作者:行者123 更新时间:2023-11-29 02:45:22 24 4
gpt4 key购买 nike

当我在 Kibana 中看到结果时,我发现没有来自 JSON 的字段,此外,message 字段仅包含 "status": "FAILED"

是否可以从 json 中解析字段并在 Kibana 中显示它们?我有以下配置:

input {
file {
type => "json"
path => "/home/logstash/test.json"
codec => json
sincedb_path => "/home/logstash/sincedb"
}
}

output {
stdout {}
elasticsearch {
protocol => "http"
codec => "json"
host => "elasticsearch.dev"
port => "9200"
}
}

以及以下 JSON 文件:

[{"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,"stop":1419621640491,"duration":17309},"severity":"NORMAL","status":"FAILED"},{"uid":"a88c89b377aca0c9","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,"stop":1419621640634,"duration":17452},"severity":"NORMAL","status":"FAILED"},{"uid":"32c3f8b52386c85c","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623185,"stop":1419621640826,"duration":17641},"severity":"NORMAL","status":"FAILED"}]

最佳答案

是的。你需要在你的配置中添加一个过滤器,就像这样。

filter{
json{
source => "message"
}
}

它在文档中描述得很好 here

编辑json 编解码器似乎不喜欢传入数组。单个元素适用于此配置:

输入:

{"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,       "stop":1419621640491,"duration":17309      },      "severity":"NORMAL",      "status":"FAILED"   }

Logstash 结果:

{
"message" => "{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182, \"stop\":1419621640491,\"duration\":17309 }, \"severity\":\"NORMAL\", \"status\":\"FAILED\" }",
"@version" => "1",
"@timestamp" => "2015-02-26T23:25:12.011Z",
"host" => "emmet.local",
"uid" => "441d1d1dd296fe60",
"name" => "test_buylinks",
"title" => "Testbuylinks",
"time" => {
"start" => 1419621623182,
"stop" => 1419621640491,
"duration" => 17309
},
"severity" => "NORMAL",
"status" => "FAILED"

现在有一个数组:

输入

[{"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,       "stop":1419621640491,"duration":17309      },      "severity":"NORMAL",      "status":"FAILED"   }, {"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,       "stop":1419621640491,"duration":17309      },      "severity":"NORMAL",      "status":"FAILED"   }]

结果:

Trouble parsing json {:source=>"message", :raw=>"[{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }, {\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }]", :exception=>#<TypeError: can't convert Array into Hash>, :level=>:warn}
{
"message" => "[{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182, \"stop\":1419621640491,\"duration\":17309 }, \"severity\":\"NORMAL\", \"status\":\"FAILED\" }, {\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182, \"stop\":1419621640491,\"duration\":17309 }, \"severity\":\"NORMAL\", \"status\":\"FAILED\" }]",
"@version" => "1",
"@timestamp" => "2015-02-26T23:28:21.195Z",
"host" => "emmet.local",
"tags" => [
[0] "_jsonparsefailure"
]
}

这看起来像是编解码器中的错误,您可以将消息更改为对象而不是数组吗?

关于elasticsearch - Logstash 不解析 json,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/28753921/

24 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com