Logstash - JSON格式文件轉(zhuǎn)換

一份簡單可用的JSON轉(zhuǎn)換配置 test.log ``` {"time":1526659044,"data":"{\"appKey\":\"7b9a2890-5754-11e8-983c-6b4bcc3b7c2e\",\"channelCode\":\"\",\"channelId\":\"\",\"createDateTime\":1526659043119,\"path\":\"\",\"query\":{},\"retain\":\"17670\",\"shareId\":\"\",\"scene\":\"\",\"type\":\"login_out\",\"userId\":\"\"}"} {"time":1526659044,"data":"{\"appKey\":\"7b9a2890-5754-11e8-983c-6b4bcc3b7c2e\",\"channelCode\":\"\",\"channelId\":\"\",\"createDateTime\":1526659043119,\"path\":\"\",\"query\":{},\"retain\":\"17670\",\"shareId\":\"\",\"scene\":\"\",\"type\":\"login_out\",\"userId\":\"asdfas-asdf_sad\"}"} {"time":1526659044,"data":"{\"appKey\":\"7b9a2890-5754-11e8-983c-6b4bcc3b7c2e\",\"channelCode\":\"\",\"channelId\":\"\",\"createDateTime\":1526659043119,\"path\":\"\",\"query\":{},\"retain\":\"17670\",\"shareId\":\"\",\"scene\":\"\",\"type\":\"login_out\",\"userId\":\"asdfas-asdf_sad\"}"} {"time":1527844300209,"data":"{\"appKey\":\"7b9a2890-5754-11e8-983c-6b4bcc3b7c2e\",\"channelCode\":\"\",\"channelId\":\"\",\"createDateTime\":1526659043119,\"path\":\"\",\"query\":{},\"retain\":\"17670\",\"shareId\":\"\",\"scene\":\"\",\"type\":\"login_out\",\"userId\":\"asdfas-asdf_sad\"}"} ``` json.conf ``` input { file { path => '/home/lake/dounine/github/logstash/test.log' start_position => "beginning" sincedb_path => "/home/lake/dounine/github/logstash/access_progress.log" } } filter{ mutate{ gsub => [ "message", '\\"', '"', "message", '"{', '{', "message", '}"', '}' ] } json{ source => "message" add_field => { "uid" => "%{[data][userId]}" } add_field => { "gsm" => "%{[data][channelCode]}" } add_field => { "sid" => "%{[data][shareId]}" } add_field => { "type" => "%{[data][type]}" } add_field => { "ak" => "%{[data][appKey]}" } } if[gsm]!=''{ mutate{ split => ["gsm" , "-"] add_field => [ "gname","%{[gsm][0]}" ] add_field => [ "sence","%{[gsm][1]}" ] add_field => [ "material","%{[gsm][2]}" ] } mutate{ join => ["gsm" , "_"] } }else{ mutate{ remove_field => ["gsm"] } } if[sid]==''{ mutate{ remove_field => ["sid"] } } date { match => ["time", "UNIX"] #UNIX_MS target => "time" #add_field => {"date"=>"%{+yyyy-M-dd}"} } ruby { code => "event.set('time', event.get('time').time.localtime + 8*60*60)" #+8小時 } mutate{ gsub => [ "uid", '-', '_' , "sid", '-', '_' , "ak", '-', '_' ] remove_field => ["message","host","@version","userId","data","path"] } } output{ if[uid]!=''{ stdout{ codec => rubydebug } elasticsearch{ hosts => ["127.0.0.1:9200"] index => "analysis3" document_type => "analysis_log" } } } ``` --- ![](https://upload-images.jianshu.io/upload_images/9028759-5619fe0d9edd7a1b.png?imageMogr2/auto-orient/strip%7CimageView2/2/w/1240)
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
【社區(qū)內(nèi)容提示】社區(qū)部分內(nèi)容疑似由AI輔助生成，瀏覽時請結(jié)合常識與多方信息審慎甄別。
平臺聲明：文章內(nèi)容（如有圖片或視頻亦包括在內(nèi)）由作者上傳并發(fā)布，文章內(nèi)容僅代表作者本人觀點(diǎn)，簡書系信息發(fā)布平臺，僅提供信息存儲服務(wù)。

相關(guān)閱讀更多精彩內(nèi)容

友情鏈接更多精彩內(nèi)容