我有一个日志文件看起来像这样(简体)
的logline样本
MyLine data={"firstname":"bob","lastname":"the builder"}
我想提取包含在数据中的JSON和创建两个领域,一个名字,一个到最后。然而,在输出中我得到是这样的:
{"message":"Line data={\"firstname\":\"bob\",\"lastname\":\"the builder\"}\r","@version":"1","@timestamp":"2015-11-26T11:38:56.700Z","host":"xxx","path":"C:/logstashold/bin/input.txt","MyWord":"Line","parsedJson":{"firstname":"bob","lastname":"the builder"}}
如你看到的
..."parsedJson":{"firstname":"bob","lastname":"the builder"}}
这不是我需要什么,我需要创建名字和姓氏的kibana领域,但logstash不与JSON过滤器提取出的字段。
LogStash配置
input {
file {
path => "C:/logstashold/bin/input.txt"
}
}
filter {
grok {
match => { "message" => "%{WORD:MyWord} data=%{GREEDYDATA:request}"}
}
json{
source => "request"
target => "parsedJson"
remove_field=>["request"]
}
}
output {
file{
path => "C:/logstashold/bin/output.txt"
}
}
任何帮助非常感谢,我敢肯定,我错过了一些东西简单
谢谢
您json
过滤器后再添一个,以补充一点,你会采取从mutate
领域的两个字段名为parsedJson
。
filter {
...
json {
...
}
mutate {
add_field => {
"firstname" => "%{[parsedJson][firstname]}"
"lastname" => "%{[parsedJson][lastname]}"
}
}
}
对于上面你的样本日志行会给:
{
"message" => "MyLine data={\"firstname\":\"bob\",\"lastname\":\"the builder\"}",
"@version" => "1",
"@timestamp" => "2015-11-26T11:54:52.556Z",
"host" => "iMac.local",
"MyWord" => "MyLine",
"parsedJson" => {
"firstname" => "bob",
"lastname" => "the builder"
},
"firstname" => "bob",
"lastname" => "the builder"
}