elasticsearch - json输入文件的logstash问题

Question

我在文件中有以下 json-

{
"foo":"bar",
"spam" : "eggs"
},
{
"css":"ddq",
"eeqw": "fewq"
}

和以下conf文件-

input { 
file
{ 
   path => "/opt/logstash-1.4.2/bin/sam.json"
   type => "json"
   codec => json_lines
   start_position =>"beginning"
 }
}
output { stdout {  codec => json  } }

但是当我运行时

./logstash -f sample.conf

我在标准输出中没有得到任何输出。

但是当我不给 json 作为编解码器并给 type => "core2"时，它似乎可以工作。
任何人都知道我如何修复它以适用于 json 类型。

另一个问题是它在给出标准输出时给了我以下输出-

{"message":"{","@version":"1","@timestamp":"2015-07-15T02:02:02.653Z","type":"core2","host":"sjagannath","path":"/opt/logstash-1.4.2/bin/sam.json"}{"message":"\"foo\":\"bar\", ","@version":"1","@timestamp":"2015-07-15T02:02:02.654Z","type":"core2","host":"sjagannath","path":"/opt/logstash-1.4.2/bin/sam.json"}{"message":"\"spam\" : \"eggs\" ","@version":"1","@timestamp":"2015-07-15T02:02:02.655Z","type":"core2","host":"sjagannath","path":"/opt/logstash-1.4.2/bin/sam.json"}{"message":"},","@version":"1","@timestamp":"2015-07-15T02:02:02.655Z","type":"core2","host":"sjagannath","path":"/opt/logstash-1.4.2/bin/sam.json"}{"message":"{ ","@version":"1","@timestamp":"2015-07-15T02:02:02.655Z","type":"core2","host":"sjagannath","path":"/opt/logstash-1.4.2/bin/sam.json"}{"message":"\"css\":\"ddq\", ","@version":"1","@timestamp":"2015-07-15T02:02:02.656Z","type":"core2","host":"sjagannath","path":"/opt/logstash-1.4.2/bin/sam.json"}{"message":"\"eeqw\": \"fewq\"","@version":"1","@timestamp":"2015-07-15T02:02:02.656Z","type":"core2","host":"sjagannath","path":"/opt/logstash-1.4.2/bin/sam.json"}{"message":"}","@version":"1","@timestamp":"2015-07-15T02:02:02.656Z","type":"core2","host":"sjagannath","path":"/opt/logstash-1.4.2/bin/sam.json"}{"message":"","@version":"1","@timestamp":"2015-07-15T02:02:02.656Z","type":"core2","host":"sjagannath","path":"/opt/logstash-1.4.2/bin/sam.json"}

我想知道如何使用输入文件中的键值对正确解析它

Answer 1

我找到了this并对其进行编辑以适合您的目的。以下配置应该完全符合您的要求:

input {   
file     {
    codec => multiline
    {
        pattern => "^\}"
        negate => true
        what => previous               
    }
    path => ["/absoute_path/json.json"]
    start_position => "beginning"
    sincedb_path => "/dev/null"
}
}

filter {
mutate    {
    replace => [ "message", "%{message}}" ]
    gsub => [ "message","\n",""]
    gsub => [ "message","},",""]
}
if [message] =~ /^{.*}$/     {
    json { source => message }
}
}

我尝试了您给定的 json，它导致了两个事件。首先是 foo = bar和 spam = eggs .第二个是 css = ddq和 eeqw = fewq .