我正在以 json 格式登录logstash,
我的日志有以下字段,每个字段都是一个字符串,atts
字段是字符串化的 json(注意:atts
子字段每次都不同)
这是一个例子:
{"name":"bob","last":"builder", "atts":"{\"a\":111, \"b\":222}"}
我想将其解析为这样的内容:
{
"name" => "bob",
"last" => "builder"
"atss" => {
"a" => 111,
"b" => 222}
}
这是我的配置:
input { stdin { } }
filter {
json {
source => "message"
target => "parsed"
}
}
output { stdout { codec => rubydebug }}
好的,
所以现在我明白了:
{
"@timestamp" => 2017-04-05T12:19:04.090Z,
"parsed" => {
"atss" => "{\"a\":111, \"b\":222}",
"name" => "bob",
"last" => "the builder"
},
"@version" => "1",
"host" => "0.0.0.0"
}
我怎样才能解析atts
字段到 json 所以我收到:
{
"@timestamp" => 2017-04-05T12:19:04.090Z,
"parsed" => {
"atss" =>
{"a" => 111,
"b" => 222},
"name" => "bob",
"last" => "the builder"
},
"@version" => "1",
"host" => "0.0.0.0"
}