Logstash解析Json array
2024-03-27 02:54:44
logstash解析json数组是一种常见的需求，我以网上一组数据为例来描述
我们的数据test.json内容如下：(此处我linux上的json文本需要是compact的)
{"type":"monitor","server":"10.111.222.333","host":"abc.de","bean":[{"name":"beanName1","reseted":"2015-06-05T15:10:00.192Z","method":[{"name":"getAllXY","count":5,"min":3,"max":5},{"name":"getName","count":4,"min":2,"max":4}]},{"name":"beanName2","reseted":"2015-06-05T15:10:00.231Z","method":[{"name":"getProperty","count":4,"min":3,"max":3}]},{"name":"beanName3","reseted":"2015-06-05T15:10:00.231Z"}]}
为了方便看清楚内容，我们format后查看：
{
"type": "monitor",
"server": "10.111.222.333",
"host": "abc.de",
"bean": [{
"name": "beanName1",
"reseted": "2015-06-05T15:10:00.192Z",
"method": [{
"name": "getAllXY",
"count": 5,
"min": 3,
"max": 5
},
{
"name": "getName",
"count": 4,
"min": 2,
"max": 4
}]
},
{
"name": "beanName2",
"reseted": "2015-06-05T15:10:00.231Z",
"method": [{
"name": "getProperty",
"count": 4,
"min": 3,
"max": 3
}]
},
{
"name": "beanName3",
"reseted": "2015-06-05T15:10:00.231Z"
}]
}
我们可以看到bean字段下是一个json数组，解析这种json数组，我们需要借用logstash split filter plugin
测试：单纯地把bean字段下的json拆分出来
我的配置文件如下
input {
file {
path => "/usr/share/logstash/private.cond/split.json"
codec => "json"
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
filter {
json {
source => "message"
}
split {
field => "bean"
}
}
output {
stdout {
codec => rubydebug
}
}
我们得到如下输出结果
{
"@version" => "1",
"server" => "10.111.222.333",
"type" => "monitor",
"bean" => {
"name" => "beanName1",
"method" => [
[0] {
"min" => 3,
"name" => "getAllXY",
"count" => 5,
"max" => 5
},
[1] {
"min" => 2,
"name" => "getName",
"count" => 4,
"max" => 4
}
],
"reseted" => "2015-06-05T15:10:00.192Z"
},
"path" => "/usr/share/logstash/private.cond/split.json",
"@timestamp" => 2018-08-02T10:36:21.248Z,
"host" => "abc.de"
}
{
"@version" => "1",
"server" => "10.111.222.333",
"type" => "monitor",
"bean" => {
"name" => "beanName2",
"method" => [
[0] {
"min" => 3,
"name" => "getProperty",
"count" => 4,
"max" => 3
}
],
"reseted" => "2015-06-05T15:10:00.231Z"
},
"path" => "/usr/share/logstash/private.cond/split.json",
"@timestamp" => 2018-08-02T10:36:21.248Z,
"host" => "abc.de"
}
{
"@version" => "1",
"server" => "10.111.222.333",
"type" => "monitor",
"bean" => {
"reseted" => "2015-06-05T15:10:00.231Z",
"name" => "beanName3"
},
"path" => "/usr/share/logstash/private.cond/split.json",
"@timestamp" => 2018-08-02T10:36:21.248Z,
"host" => "abc.de"
}
根据输出我们可以看到json数组被我单个拆分出来。
最新文章
- 第三章 Git使用入门
- 解剖SQLSERVER 第十三篇 Integers在行压缩和页压缩里的存储格式揭秘（译）
- atitit.404错误的排查流程总结vOa6
- java实验一实验报告
- HDU 4770 Lights Against Dudely
- <c:forEach> 详解
- Android学习笔记（三）Application类简介
- mergeIDE
- 树莓派做web服务器(nginx、Apache)
- 打开VMware的系统出错
- CodeForces 484D Kindergarten
- Hibernate之配置文件
- @Controller @RestController
- python django初识ajax
- FIleZilla连接linux(Ubuntu)服务器的相关问题
- 一道题引发的self和super
- python学习笔记9-单元测试unittest
- CRM WEB UI 04明细界面添加按钮
- SpringMVC深度探险（四） —— SpringMVC核心配置文件详解
- win10笔记本实现双屏显示的自如切换