我有以下 JSON 文件：
{ "UserId":"433157", "Username":"Thu Huynh", "Email":"[email protected]", "Timezone":"Mountain Standard Time", "CompanyId":"343", "Operation":"POST", "Channel":"UI", "Path":"/api/v1.0/admin/accounts/users", "Context":"Accounts GetUsersForOAAccount", "Params": { "companyId":"343", "userId":"433157", "moduleId":"1" }, "Object":"", "EventType":"Field Value Change", "DateRequested":"09/06/2023 03:20:18", "DateCompleted":"09/06/2023 03:20:18" ,"ModifiedDate":"", "ResponseCode":"200", "ResponseMessage": { "userId":433157, "companyId":343, "userGuid":"B05DE331A3F540AB8748", "username":"Thu Huynh", "companyName":"EA-QA-Company", "hostName":"GoldenComplianceAssurance.spheracloud.internal.spherasolutions.com", "currentHierarchyId":0, "eaHierarchyId":0, "timeZone":"Mountain Standard Time", "timeZoneIANA":null, "timeZoneDisplayName":null, "currentLocationId":540132, "currentNodeId":543116, "currentModelId":13022, "userTypeId":4, "emailAddress":"[email protected]", "openId":null, "accountId":0, "isSuperAdmin":0, "isLastActiveTenantDisabled":false }, "PreviousValue":"", "NewValue":""}
我有以下 Logstash 管道：
input {
# Read JSON files from the /logs/csv/ directory
file {
path => "/logs/json/*"
start_position => "beginning"
# remove this for not always starting from the beginning of the file
sincedb_path => "/dev/null"
codec => "json"
type => "json"
mode => "tail"
}
}
filter {
# Parse JSON data
json {
source => "ResponseMessage"
}
}
filter {
# Lowercase company name for set the index name properly
mutate {
lowercase => ["companyName"]
}
}
output {
if [companyName] {
elasticsearch {
hosts => [ "https://elasticsearch:9200" ]
index => "log_data_%{[companyName]}"
ssl => true
cacert => "/usr/share/logstash/config/ca.crt"
user => "elastic"
password => "changeme"
}
}
# Send data to stdout
stdout {
codec => rubydebug
}
}
当我运行此管道（在 Docker 容器中）时，我收到此错误：
eg_elastic_poc-main-logstash-1 | [2023-09-12T00:31:44,384][WARN ][logstash.filters.json ][main][fc661796945a71d1b7933530d67b2251967ffbbf026ff7feeab6a408fdd08a51] Error parsing json {:source=>"ResponseMessage", :raw=>{"currentModelId"=>13022, "isSuperAdmin"=>0, "timeZoneIANA"=>nil, "userId"=>433157, "hostName"=>"GoldenComplianceAssurance.spheracloud.internal.spherasolutions.com", "eaHierarchyId"=>0, "currentNodeId"=>543116, "currentHierarchyId"=>0, "username"=>"Thu Huynh", "currentLocationId"=>540132, "openId"=>nil, "accountId"=>0, "userTypeId"=>4, "userGuid"=>"B05DE331A3F540AB8748", "isLastActiveTenantDisabled"=>false, "emailAddress"=>"[email protected]", "companyId"=>343, "companyName"=>"EA-QA-Company", "timeZone"=>"Mountain Standard Time", "timeZoneDisplayName"=>nil}, :exception=>#<Java::JavaLang::ClassCastException: class org.jruby.RubyHash cannot be cast to class org.jruby.RubyIO (org.jruby.RubyHash and org.jruby.RubyIO are in unnamed module of loader 'app')>}
eg_elastic_poc-main-logstash-1 | [2023-09-12T00:31:44,386][WARN ][logstash.filters.json ][main][fc661796945a71d1b7933530d67b2251967ffbbf026ff7feeab6a408fdd08a51] Error parsing json {:source=>"ResponseMessage", :raw=>{"currentModelId"=>13022, "isSuperAdmin"=>0, "timeZoneIANA"=>nil, "userId"=>433157, "hostName"=>"GoldenComplianceAssurance.spheracloud.internal.spherasolutions.com", "eaHierarchyId"=>0, "currentNodeId"=>543116, "currentHierarchyId"=>0, "username"=>"Thu Huynh", "currentLocationId"=>540132, "openId"=>nil, "accountId"=>0, "userTypeId"=>4, "userGuid"=>"B05DE331A3F540AB8748", "isLastActiveTenantDisabled"=>false, "emailAddress"=>"[email protected]", "companyId"=>343, "companyName"=>"EA-QA-Company", "timeZone"=>"Mountain Standard Time", "timeZoneDisplayName"=>nil}, :exception=>#<Java::JavaLang::ClassCastException: class org.jruby.RubyHash cannot be cast to class org.jruby.RubyIO (org.jruby.RubyHash and org.jruby.RubyIO are in unnamed module of loader 'app')>}
eg_elastic_poc-main-logstash-1 | {
eg_elastic_poc-main-logstash-1 | "CompanyId" => "343",
eg_elastic_poc-main-logstash-1 | "tags" => [
eg_elastic_poc-main-logstash-1 | [0] "_jsonparsefailure"
eg_elastic_poc-main-logstash-1 | ],
eg_elastic_poc-main-logstash-1 | "Path" => "/api/v1.0/admin/accounts/users",
eg_elastic_poc-main-logstash-1 | "@timestamp" => 2023-09-12T00:31:38.314148718Z,
eg_elastic_poc-main-logstash-1 | "ResponseMessage" => {
eg_elastic_poc-main-logstash-1 | "currentModelId" => 13022,
eg_elastic_poc-main-logstash-1 | "isSuperAdmin" => 0,
eg_elastic_poc-main-logstash-1 | "timeZoneIANA" => nil,
eg_elastic_poc-main-logstash-1 | "userId" => 433157,
eg_elastic_poc-main-logstash-1 | "hostName" => "GoldenComplianceAssurance.spheracloud.internal.spherasolutions.com",
eg_elastic_poc-main-logstash-1 | "eaHierarchyId" => 0,
eg_elastic_poc-main-logstash-1 | "currentNodeId" => 543116,
eg_elastic_poc-main-logstash-1 | "currentHierarchyId" => 0,
eg_elastic_poc-main-logstash-1 | "username" => "Thu Huynh",
eg_elastic_poc-main-logstash-1 | "currentLocationId" => 540132,
eg_elastic_poc-main-logstash-1 | "openId" => nil,
eg_elastic_poc-main-logstash-1 | "accountId" => 0,
eg_elastic_poc-main-logstash-1 | "userTypeId" => 4,
eg_elastic_poc-main-logstash-1 | "userGuid" => "B05DE331A3F540AB8748",
eg_elastic_poc-main-logstash-1 | "isLastActiveTenantDisabled" => false,
eg_elastic_poc-main-logstash-1 | "emailAddress" => "[email protected]",
eg_elastic_poc-main-logstash-1 | "companyId" => 343,
eg_elastic_poc-main-logstash-1 | "companyName" => "EA-QA-Company",
eg_elastic_poc-main-logstash-1 | "timeZone" => "Mountain Standard Time",
eg_elastic_poc-main-logstash-1 | "timeZoneDisplayName" => nil
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "NewValue" => "",
eg_elastic_poc-main-logstash-1 | "PreviousValue" => "",
eg_elastic_poc-main-logstash-1 | "ModifiedDate" => "",
eg_elastic_poc-main-logstash-1 | "DateCompleted" => "09/06/2023 03:20:18",
eg_elastic_poc-main-logstash-1 | "Context" => "Accounts GetUsersForOAAccount",
eg_elastic_poc-main-logstash-1 | "@version" => "1",
eg_elastic_poc-main-logstash-1 | "Params" => {
eg_elastic_poc-main-logstash-1 | "userId" => "433157",
eg_elastic_poc-main-logstash-1 | "companyId" => "343",
eg_elastic_poc-main-logstash-1 | "moduleId" => "1"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Username" => "Thu Huynh",
eg_elastic_poc-main-logstash-1 | "DateRequested" => "09/06/2023 03:20:18",
eg_elastic_poc-main-logstash-1 | "EventType" => "Field Value Change",
eg_elastic_poc-main-logstash-1 | "Channel" => "UI",
eg_elastic_poc-main-logstash-1 | "ResponseCode" => "200",
eg_elastic_poc-main-logstash-1 | "type" => "json",
eg_elastic_poc-main-logstash-1 | "event" => {
eg_elastic_poc-main-logstash-1 | "original" => "{ \"UserId\":\"433157\", \"Username\":\"Thu Huynh\", \"Email\":\"[email protected]\", \"Timezone\":\"Mountain Standard Time\", \"CompanyId\":\"343\", \"Operation\":\"POST\", \"Channel\":\"UI\", \"Path\":\"/api/v1.0/admin/accounts/users\", \"Context\":\"Accounts GetUsersForOAAccount\", \"Params\": { \"companyId\":\"343\", \"userId\":\"433157\", \"moduleId\":\"1\" }, \"Object\":\"\", \"EventType\":\"Field Value Change\", \"DateRequested\":\"09/06/2023 03:20:18\", \"DateCompleted\":\"09/06/2023 03:20:18\" ,\"ModifiedDate\":\"\", \"ResponseCode\":\"200\", \"ResponseMessage\": { \"userId\":433157, \"companyId\":343, \"userGuid\":\"B05DE331A3F540AB8748\", \"username\":\"Thu Huynh\", \"companyName\":\"EA-QA-Company\", \"hostName\":\"GoldenComplianceAssurance.spheracloud.internal.spherasolutions.com\", \"currentHierarchyId\":0, \"eaHierarchyId\":0, \"timeZone\":\"Mountain Standard Time\", \"timeZoneIANA\":null, \"timeZoneDisplayName\":null, \"currentLocationId\":540132, \"currentNodeId\":543116, \"currentModelId\":13022, \"userTypeId\":4, \"emailAddress\":\"[email protected]\", \"openId\":null, \"accountId\":0, \"isSuperAdmin\":0, \"isLastActiveTenantDisabled\":false }, \"PreviousValue\":\"\", \"NewValue\":\"\"}"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Email" => "[email protected]",
eg_elastic_poc-main-logstash-1 | "log" => {
eg_elastic_poc-main-logstash-1 | "file" => {
eg_elastic_poc-main-logstash-1 | "path" => "/logs/json/log.json"
eg_elastic_poc-main-logstash-1 | }
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Timezone" => "Mountain Standard Time",
eg_elastic_poc-main-logstash-1 | "Operation" => "POST",
eg_elastic_poc-main-logstash-1 | "Object" => "",
eg_elastic_poc-main-logstash-1 | "host" => {
eg_elastic_poc-main-logstash-1 | "name" => "6d8fb764b55b"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "UserId" => "433157"
eg_elastic_poc-main-logstash-1 | }
eg_elastic_poc-main-logstash-1 | {
eg_elastic_poc-main-logstash-1 | "CompanyId" => "343",
eg_elastic_poc-main-logstash-1 | "tags" => [
eg_elastic_poc-main-logstash-1 | [0] "_jsonparsefailure"
eg_elastic_poc-main-logstash-1 | ],
eg_elastic_poc-main-logstash-1 | "Path" => "/api/v1.0/admin/accounts/users",
eg_elastic_poc-main-logstash-1 | "@timestamp" => 2023-09-12T00:31:38.320068968Z,
eg_elastic_poc-main-logstash-1 | "ResponseMessage" => {
eg_elastic_poc-main-logstash-1 | "currentModelId" => 13022,
eg_elastic_poc-main-logstash-1 | "isSuperAdmin" => 0,
eg_elastic_poc-main-logstash-1 | "timeZoneIANA" => nil,
eg_elastic_poc-main-logstash-1 | "userId" => 433157,
eg_elastic_poc-main-logstash-1 | "hostName" => "GoldenComplianceAssurance.spheracloud.internal.spherasolutions.com",
eg_elastic_poc-main-logstash-1 | "eaHierarchyId" => 0,
eg_elastic_poc-main-logstash-1 | "currentNodeId" => 543116,
eg_elastic_poc-main-logstash-1 | "currentHierarchyId" => 0,
eg_elastic_poc-main-logstash-1 | "username" => "Thu Huynh",
eg_elastic_poc-main-logstash-1 | "currentLocationId" => 540132,
eg_elastic_poc-main-logstash-1 | "openId" => nil,
eg_elastic_poc-main-logstash-1 | "accountId" => 0,
eg_elastic_poc-main-logstash-1 | "userTypeId" => 4,
eg_elastic_poc-main-logstash-1 | "userGuid" => "B05DE331A3F540AB8748",
eg_elastic_poc-main-logstash-1 | "isLastActiveTenantDisabled" => false,
eg_elastic_poc-main-logstash-1 | "emailAddress" => "[email protected]",
eg_elastic_poc-main-logstash-1 | "companyId" => 343,
eg_elastic_poc-main-logstash-1 | "companyName" => "EA-QA-Company",
eg_elastic_poc-main-logstash-1 | "timeZone" => "Mountain Standard Time",
eg_elastic_poc-main-logstash-1 | "timeZoneDisplayName" => nil
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "NewValue" => "",
eg_elastic_poc-main-logstash-1 | "PreviousValue" => "",
eg_elastic_poc-main-logstash-1 | "ModifiedDate" => "",
eg_elastic_poc-main-logstash-1 | "DateCompleted" => "09/06/2023 03:20:18",
eg_elastic_poc-main-logstash-1 | "Context" => "Accounts GetUsersForOAAccount",
eg_elastic_poc-main-logstash-1 | "@version" => "1",
eg_elastic_poc-main-logstash-1 | "Params" => {
eg_elastic_poc-main-logstash-1 | "userId" => "433157",
eg_elastic_poc-main-logstash-1 | "companyId" => "343",
eg_elastic_poc-main-logstash-1 | "moduleId" => "1"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Username" => "Thu Huynh",
eg_elastic_poc-main-logstash-1 | "DateRequested" => "09/06/2023 03:20:18",
eg_elastic_poc-main-logstash-1 | "EventType" => "Field Value Change",
eg_elastic_poc-main-logstash-1 | "Channel" => "UI",
eg_elastic_poc-main-logstash-1 | "ResponseCode" => "200",
eg_elastic_poc-main-logstash-1 | "type" => "json",
eg_elastic_poc-main-logstash-1 | "event" => {
eg_elastic_poc-main-logstash-1 | "original" => "{ \"UserId\":\"433157\", \"Username\":\"Thu Huynh\", \"Email\":\"[email protected]\", \"Timezone\":\"Mountain Standard Time\", \"CompanyId\":\"343\", \"Operation\":\"POST\", \"Channel\":\"UI\", \"Path\":\"/api/v1.0/admin/accounts/users\", \"Context\":\"Accounts GetUsersForOAAccount\", \"Params\": { \"companyId\":\"343\", \"userId\":\"433157\", \"moduleId\":\"1\" }, \"Object\":\"\", \"EventType\":\"Field Value Change\", \"DateRequested\":\"09/06/2023 03:20:18\", \"DateCompleted\":\"09/06/2023 03:20:18\" ,\"ModifiedDate\":\"\", \"ResponseCode\":\"200\", \"ResponseMessage\": { \"userId\":433157, \"companyId\":343, \"userGuid\":\"B05DE331A3F540AB8748\", \"username\":\"Thu Huynh\", \"companyName\":\"EA-QA-Company\", \"hostName\":\"GoldenComplianceAssurance.spheracloud.internal.spherasolutions.com\", \"currentHierarchyId\":0, \"eaHierarchyId\":0, \"timeZone\":\"Mountain Standard Time\", \"timeZoneIANA\":null, \"timeZoneDisplayName\":null, \"currentLocationId\":540132, \"currentNodeId\":543116, \"currentModelId\":13022, \"userTypeId\":4, \"emailAddress\":\"[email protected]\", \"openId\":null, \"accountId\":0, \"isSuperAdmin\":0, \"isLastActiveTenantDisabled\":false }, \"PreviousValue\":\"\", \"NewValue\":\"\"}"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Email" => "[email protected]",
eg_elastic_poc-main-logstash-1 | "log" => {
eg_elastic_poc-main-logstash-1 | "file" => {
eg_elastic_poc-main-logstash-1 | "path" => "/logs/json/log.json"
eg_elastic_poc-main-logstash-1 | }
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Timezone" => "Mountain Standard Time",
eg_elastic_poc-main-logstash-1 | "Operation" => "POST",
eg_elastic_poc-main-logstash-1 | "Object" => "",
eg_elastic_poc-main-logstash-1 | "host" => {
eg_elastic_poc-main-logstash-1 | "name" => "6d8fb764b55b"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "UserId" => "433157"
eg_elastic_poc-main-logstash-1 | }
eg_elastic_poc-main-logstash-1 | {
eg_elastic_poc-main-logstash-1 | "CompanyId" => "343",
eg_elastic_poc-main-logstash-1 | "tags" => [
eg_elastic_poc-main-logstash-1 | [0] "_jsonparsefailure"
eg_elastic_poc-main-logstash-1 | ],
eg_elastic_poc-main-logstash-1 | "Path" => "/api/v1.0/admin/accounts/users",
eg_elastic_poc-main-logstash-1 | "@timestamp" => 2023-09-12T00:31:38.314148718Z,
eg_elastic_poc-main-logstash-1 | "ResponseMessage" => {
eg_elastic_poc-main-logstash-1 | "currentModelId" => 13022,
eg_elastic_poc-main-logstash-1 | "isSuperAdmin" => 0,
eg_elastic_poc-main-logstash-1 | "timeZoneIANA" => nil,
eg_elastic_poc-main-logstash-1 | "userId" => 433157,
eg_elastic_poc-main-logstash-1 | "hostName" => "GoldenComplianceAssurance.spheracloud.internal.spherasolutions.com",
eg_elastic_poc-main-logstash-1 | "eaHierarchyId" => 0,
eg_elastic_poc-main-logstash-1 | "currentNodeId" => 543116,
eg_elastic_poc-main-logstash-1 | "currentHierarchyId" => 0,
eg_elastic_poc-main-logstash-1 | "username" => "Thu Huynh",
eg_elastic_poc-main-logstash-1 | "currentLocationId" => 540132,
eg_elastic_poc-main-logstash-1 | "openId" => nil,
eg_elastic_poc-main-logstash-1 | "accountId" => 0,
eg_elastic_poc-main-logstash-1 | "userTypeId" => 4,
eg_elastic_poc-main-logstash-1 | "userGuid" => "B05DE331A3F540AB8748",
eg_elastic_poc-main-logstash-1 | "isLastActiveTenantDisabled" => false,
eg_elastic_poc-main-logstash-1 | "emailAddress" => "[email protected]",
eg_elastic_poc-main-logstash-1 | "companyId" => 343,
eg_elastic_poc-main-logstash-1 | "companyName" => "EA-QA-Company",
eg_elastic_poc-main-logstash-1 | "timeZone" => "Mountain Standard Time",
eg_elastic_poc-main-logstash-1 | "timeZoneDisplayName" => nil
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "NewValue" => "",
eg_elastic_poc-main-logstash-1 | "PreviousValue" => "",
eg_elastic_poc-main-logstash-1 | "ModifiedDate" => "",
eg_elastic_poc-main-logstash-1 | "DateCompleted" => "09/06/2023 03:20:18",
eg_elastic_poc-main-logstash-1 | "Context" => "Accounts GetUsersForOAAccount",
eg_elastic_poc-main-logstash-1 | "@version" => "1",
eg_elastic_poc-main-logstash-1 | "Params" => {
eg_elastic_poc-main-logstash-1 | "userId" => "433157",
eg_elastic_poc-main-logstash-1 | "companyId" => "343",
eg_elastic_poc-main-logstash-1 | "moduleId" => "1"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Username" => "Thu Huynh",
eg_elastic_poc-main-logstash-1 | "DateRequested" => "09/06/2023 03:20:18",
eg_elastic_poc-main-logstash-1 | "EventType" => "Field Value Change",
eg_elastic_poc-main-logstash-1 | "Channel" => "UI",
eg_elastic_poc-main-logstash-1 | "ResponseCode" => "200",
eg_elastic_poc-main-logstash-1 | "type" => "json",
eg_elastic_poc-main-logstash-1 | "event" => {
eg_elastic_poc-main-logstash-1 | "original" => "{ \"UserId\":\"433157\", \"Username\":\"Thu Huynh\", \"Email\":\"[email protected]\", \"Timezone\":\"Mountain Standard Time\", \"CompanyId\":\"343\", \"Operation\":\"POST\", \"Channel\":\"UI\", \"Path\":\"/api/v1.0/admin/accounts/users\", \"Context\":\"Accounts GetUsersForOAAccount\", \"Params\": { \"companyId\":\"343\", \"userId\":\"433157\", \"moduleId\":\"1\" }, \"Object\":\"\", \"EventType\":\"Field Value Change\", \"DateRequested\":\"09/06/2023 03:20:18\", \"DateCompleted\":\"09/06/2023 03:20:18\" ,\"ModifiedDate\":\"\", \"ResponseCode\":\"200\", \"ResponseMessage\": { \"userId\":433157, \"companyId\":343, \"userGuid\":\"B05DE331A3F540AB8748\", \"username\":\"Thu Huynh\", \"companyName\":\"EA-QA-Company\", \"hostName\":\"GoldenComplianceAssurance.spheracloud.internal.spherasolutions.com\", \"currentHierarchyId\":0, \"eaHierarchyId\":0, \"timeZone\":\"Mountain Standard Time\", \"timeZoneIANA\":null, \"timeZoneDisplayName\":null, \"currentLocationId\":540132, \"currentNodeId\":543116, \"currentModelId\":13022, \"userTypeId\":4, \"emailAddress\":\"[email protected]\", \"openId\":null, \"accountId\":0, \"isSuperAdmin\":0, \"isLastActiveTenantDisabled\":false }, \"PreviousValue\":\"\", \"NewValue\":\"\"}"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Email" => "[email protected]",
eg_elastic_poc-main-logstash-1 | "log" => {
eg_elastic_poc-main-logstash-1 | "file" => {
eg_elastic_poc-main-logstash-1 | "path" => "/logs/json/log.json"
eg_elastic_poc-main-logstash-1 | }
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Timezone" => "Mountain Standard Time",
eg_elastic_poc-main-logstash-1 | "Operation" => "POST",
eg_elastic_poc-main-logstash-1 | "Object" => "",
eg_elastic_poc-main-logstash-1 | "host" => {
eg_elastic_poc-main-logstash-1 | "name" => "6d8fb764b55b"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "UserId" => "433157"
eg_elastic_poc-main-logstash-1 | }
eg_elastic_poc-main-logstash-1 | {
eg_elastic_poc-main-logstash-1 | "CompanyId" => "343",
eg_elastic_poc-main-logstash-1 | "tags" => [
eg_elastic_poc-main-logstash-1 | [0] "_jsonparsefailure"
eg_elastic_poc-main-logstash-1 | ],
eg_elastic_poc-main-logstash-1 | "Path" => "/api/v1.0/admin/accounts/users",
eg_elastic_poc-main-logstash-1 | "@timestamp" => 2023-09-12T00:31:38.320068968Z,
eg_elastic_poc-main-logstash-1 | "ResponseMessage" => {
eg_elastic_poc-main-logstash-1 | "currentModelId" => 13022,
eg_elastic_poc-main-logstash-1 | "isSuperAdmin" => 0,
eg_elastic_poc-main-logstash-1 | "timeZoneIANA" => nil,
eg_elastic_poc-main-logstash-1 | "userId" => 433157,
eg_elastic_poc-main-logstash-1 | "hostName" => "GoldenComplianceAssurance.spheracloud.internal.spherasolutions.com",
eg_elastic_poc-main-logstash-1 | "eaHierarchyId" => 0,
eg_elastic_poc-main-logstash-1 | "currentNodeId" => 543116,
eg_elastic_poc-main-logstash-1 | "currentHierarchyId" => 0,
eg_elastic_poc-main-logstash-1 | "username" => "Thu Huynh",
eg_elastic_poc-main-logstash-1 | "currentLocationId" => 540132,
eg_elastic_poc-main-logstash-1 | "openId" => nil,
eg_elastic_poc-main-logstash-1 | "accountId" => 0,
eg_elastic_poc-main-logstash-1 | "userTypeId" => 4,
eg_elastic_poc-main-logstash-1 | "userGuid" => "B05DE331A3F540AB8748",
eg_elastic_poc-main-logstash-1 | "isLastActiveTenantDisabled" => false,
eg_elastic_poc-main-logstash-1 | "emailAddress" => "[email protected]",
eg_elastic_poc-main-logstash-1 | "companyId" => 343,
eg_elastic_poc-main-logstash-1 | "companyName" => "EA-QA-Company",
eg_elastic_poc-main-logstash-1 | "timeZone" => "Mountain Standard Time",
eg_elastic_poc-main-logstash-1 | "timeZoneDisplayName" => nil
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "NewValue" => "",
eg_elastic_poc-main-logstash-1 | "PreviousValue" => "",
eg_elastic_poc-main-logstash-1 | "ModifiedDate" => "",
eg_elastic_poc-main-logstash-1 | "DateCompleted" => "09/06/2023 03:20:18",
eg_elastic_poc-main-logstash-1 | "Context" => "Accounts GetUsersForOAAccount",
eg_elastic_poc-main-logstash-1 | "@version" => "1",
eg_elastic_poc-main-logstash-1 | "Params" => {
eg_elastic_poc-main-logstash-1 | "userId" => "433157",
eg_elastic_poc-main-logstash-1 | "companyId" => "343",
eg_elastic_poc-main-logstash-1 | "moduleId" => "1"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Username" => "Thu Huynh",
eg_elastic_poc-main-logstash-1 | "DateRequested" => "09/06/2023 03:20:18",
eg_elastic_poc-main-logstash-1 | "EventType" => "Field Value Change",
eg_elastic_poc-main-logstash-1 | "Channel" => "UI",
eg_elastic_poc-main-logstash-1 | "ResponseCode" => "200",
eg_elastic_poc-main-logstash-1 | "type" => "json",
eg_elastic_poc-main-logstash-1 | "event" => {
eg_elastic_poc-main-logstash-1 | "original" => "{ \"UserId\":\"433157\", \"Username\":\"Thu Huynh\", \"Email\":\"[email protected]\", \"Timezone\":\"Mountain Standard Time\", \"CompanyId\":\"343\", \"Operation\":\"POST\", \"Channel\":\"UI\", \"Path\":\"/api/v1.0/admin/accounts/users\", \"Context\":\"Accounts GetUsersForOAAccount\", \"Params\": { \"companyId\":\"343\", \"userId\":\"433157\", \"moduleId\":\"1\" }, \"Object\":\"\", \"EventType\":\"Field Value Change\", \"DateRequested\":\"09/06/2023 03:20:18\", \"DateCompleted\":\"09/06/2023 03:20:18\" ,\"ModifiedDate\":\"\", \"ResponseCode\":\"200\", \"ResponseMessage\": { \"userId\":433157, \"companyId\":343, \"userGuid\":\"B05DE331A3F540AB8748\", \"username\":\"Thu Huynh\", \"companyName\":\"EA-QA-Company\", \"hostName\":\"GoldenComplianceAssurance.spheracloud.internal.spherasolutions.com\", \"currentHierarchyId\":0, \"eaHierarchyId\":0, \"timeZone\":\"Mountain Standard Time\", \"timeZoneIANA\":null, \"timeZoneDisplayName\":null, \"currentLocationId\":540132, \"currentNodeId\":543116, \"currentModelId\":13022, \"userTypeId\":4, \"emailAddress\":\"[email protected]\", \"openId\":null, \"accountId\":0, \"isSuperAdmin\":0, \"isLastActiveTenantDisabled\":false }, \"PreviousValue\":\"\", \"NewValue\":\"\"}"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Email" => "[email protected]",
eg_elastic_poc-main-logstash-1 | "log" => {
eg_elastic_poc-main-logstash-1 | "file" => {
eg_elastic_poc-main-logstash-1 | "path" => "/logs/json/log.json"
eg_elastic_poc-main-logstash-1 | }
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "Timezone" => "Mountain Standard Time",
eg_elastic_poc-main-logstash-1 | "Operation" => "POST",
eg_elastic_poc-main-logstash-1 | "Object" => "",
eg_elastic_poc-main-logstash-1 | "host" => {
eg_elastic_poc-main-logstash-1 | "name" => "6d8fb764b55b"
eg_elastic_poc-main-logstash-1 | },
eg_elastic_poc-main-logstash-1 | "UserId" => "433157"
eg_elastic_poc-main-logstash-1 | }
eg_elastic_poc-main-kibana-1 | [2023-09-12T00:31:47.120+00:00][INFO ][status] Kibana is now available (was degraded)
eg_elastic_poc-main-kibana-1 | [2023-09-12T00:31:47.129+00:00][INFO ][plugins.ml] Task ML:saved-objects-sync-task: No ML saved objects in need of synchronization
我可以更改什么（在 JSON 文件中或在管道中）来解析此输入而不会出现错误？
为了解决这个问题，我必须将“源”从“ResponseMessage”更改为“消息”