我正在尝试将 JSON 数组拆分为多个事件。这是一个示例输入:
{"results" : [{"id": "a1", "name": "hello"}, {"id": "a2", "name": "logstash"}]}
这是我的过滤器和输出配置:
filter {
split {
field => "results"
}
}
stdout {
codec => "rubydebug"
}
这会生成 2 个事件,一个事件对应数组中的每个 JSON。它接近我正在寻找的东西:
{
"results" => {
"id" => "a1",
"name" => "hello"
},
"@version" => "1",
"@timestamp" => "2015-05-30T18:33:21.527Z",
"host" => "laptop",
}
{
"results" => {
"id" => "a2",
"name" => "logstash"
},
"@version" => "1",
"@timestamp" => "2015-05-30T18:33:21.527Z",
"host" => "laptop",
}
问题在于嵌套的“结果”部分。 “结果”是目标参数的默认值。
有没有办法在不生成嵌套 JSON 的情况下使用拆分过滤器,并得到如下内容:
{
"id" => "a1",
"name" => "hello"
"@version" => "1",
"@timestamp" => "2015-05-30T18:33:21.527Z",
"host" => "laptop",
}
{
"id" => "a2",
"name" => "logstash"
"@version" => "1",
"@timestamp" => "2015-05-30T18:33:21.527Z",
"host" => "laptop",
}
目的是将其提供给 ElasticSearch 输出,每个事件都是一个带有 document_id => "id" 的文档。欢迎大家提出好的解决方案!