发生Ruby异常：在logstash中未定义方法`to_json'。

Question

只是好奇如何解决 发生Ruby异常：未定义方法`to_json'。 ?

logstash的版本是6.3.2。

"journalctl -u logstash "返回。

May 15 13:33:13 server-4-eu-central-1.sample.com logstash[2382]: [2020-05-15T13:33:13,818][ERROR][logstash.filters.ruby    ] Ruby exception occurred: undefined method `to_json' for #<Hash:0x7a9ee4b7>
May 15 13:33:13 server-4-eu-central-1.sample.com logstash[2382]: [2020-05-15T13:33:13,819][ERROR][logstash.filters.ruby    ] Ruby exception occurred: undefined method `to_json' for #<Hash:0x1a6464f3>
May 15 13:33:13 server-4-eu-central-1.sample.com logstash[2382]: [2020-05-15T13:33:13,820][ERROR][logstash.filters.ruby    ] Ruby exception occurred: undefined method `to_json' for #<Hash:0x34a23ab2>
...

我的000_sample.conf配置文件。

input { ...  }

filter {
    if [type] == "sample-client-logs" {
      json {
        source => "message"
      }
      ...
      if [principal] =~ /(?i)sfe|android|ios|kraken-analytics/ {
        json {
          source => "message"
          target => "[jsonPayload][message]"
          add_field => {
            "[jsonPayload][customer]" => "server-4-eu-central-1"
            "[jsonPayload][source]" => "sample-client-logs.log"
            "[jsonPayload][serviceContext][service]" => "cloud-log-harvester"
            "[jsonPayload][serviceContext][version]" => "null"
            "[jsonPayload][principal]" => "%{[jsonPayload][message][principal]}"
            "[resource][labels][instance_id]" => "%{host}"
            "[resource][labels][region]" => "aws:"
            "[resource][type]" => "aws_instance"
          }
          remove_field => ["message", "[jsonPayload][message][message]", "env", "logicalRegion", "@timestamp", "@version", "path", "host"]
        }
        ruby {
          code => 'event.set("[jsonPayload][message]", event.get("[jsonPayload][message]").to_json)'
        }
      }
      ...
    }
    ...
}

output {...}

Answer 1

我找到了答案。

    ruby {
      code => "
        require 'json'
        event.set('[jsonPayload][message]', event.get('[jsonPayload][message]').to_json)
      "
    }

注意不要把'=>'换成'='，注意把双引号换成单引号。