更新时间:2023-11-22 12:01:40
是的。你需要在你的配置中添加一个过滤器,这样一来。
Yes. you need to add a filter to your config, something like this.
filter{
json{
source => "message"
}
}
在文档中描述的很好a href =http://logstash.net/docs/1.4.2/filters/json =noreferrer> here
It's described pretty well in the docs here
编辑
json编解码器似乎并不喜欢有一个数组传入。一个单一的元素适用于这个配置:
EDIT The json codec doesn't seem to like having an array passed in. A single element works with this config:
输入:
{"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182, "stop":1419621640491,"duration":17309 }, "severity":"NORMAL", "status":"FAILED" }
Logstash结果
{
"message" => "{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182, \"stop\":1419621640491,\"duration\":17309 }, \"severity\":\"NORMAL\", \"status\":\"FAILED\" }",
"@version" => "1",
"@timestamp" => "2015-02-26T23:25:12.011Z",
"host" => "emmet.local",
"uid" => "441d1d1dd296fe60",
"name" => "test_buylinks",
"title" => "Testbuylinks",
"time" => {
"start" => 1419621623182,
"stop" => 1419621640491,
"duration" => 17309
},
"severity" => "NORMAL",
"status" => "FAILED"
}
一个数组:
输入
[{"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182, "stop":1419621640491,"duration":17309 }, "severity":"NORMAL", "status":"FAILED" }, {"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182, "stop":1419621640491,"duration":17309 }, "severity":"NORMAL", "status":"FAILED" }]
结果:
Trouble parsing json {:source=>"message", :raw=>"[{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182, \"stop\":1419621640491,\"duration\":17309 }, \"severity\":\"NORMAL\", \"status\":\"FAILED\" }, {\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182, \"stop\":1419621640491,\"duration\":17309 }, \"severity\":\"NORMAL\", \"status\":\"FAILED\" }]", :exception=>#<TypeError: can't convert Array into Hash>, :level=>:warn}
{
"message" => "[{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182, \"stop\":1419621640491,\"duration\":17309 }, \"severity\":\"NORMAL\", \"status\":\"FAILED\" }, {\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182, \"stop\":1419621640491,\"duration\":17309 }, \"severity\":\"NORMAL\", \"status\":\"FAILED\" }]",
"@version" => "1",
"@timestamp" => "2015-02-26T23:28:21.195Z",
"host" => "emmet.local",
"tags" => [
[0] "_jsonparsefailure"
]
}
这看起来像编解码器中的错误,您可以将消息更改为对象而不是数组吗?
This looks like a bug in the codec, can you change your messages to an object rather than an array?