如何为json输入文件编写日志存储配置

pbwdgjma  于 2021-06-14  发布在  ElasticSearch
关注(0)|答案(0)|浏览(158)

我在下面添加了json文件,我正在尝试使用logstash conf文件从json数据生成字段。请建议我如何写配置创建ElasticSearch个别领域。

enter code here

"count": 15,
"value": [
{
"_links": {
"self": {
"href": "hyperlink"
},
"web": {
"href": "hyperlink"
},
"pipeline.web": {
"href": "hyperlink"
},
"pipeline": {
"href": "hyperlink"
}
},
"pipeline": {
"url": "hyperlink",
"id": 90,
"revision": 4,
"name": "Name",
"folder": "\"
},
"state": "completed",
"result": "succeeded",
"createdDate": "2020-10-21T20:00:02.2490446Z",
"finishedDate": "2020-10-21T20:11:17.5898951Z",
"url": "hyperlink",
"id": 6254,
"name": "0.1.0-integration.1+47"
},

我的日志存储配置是

input {
  file {
        type => "json"
    start_position => "beginning"
        path => "/home/dataflow/example.json"
        sincedb_path => "/dev/null"
        codec => multiline {
      pattern => "^"
      negate => false
      what => "previous"
      auto_flush_interval => 2
    }
        }
}
filter {
  json {
    source => "message"
  }
}

它像单个行一样存储索引作为消息。。
我的要求是将所有内容转换为字段
提前谢谢。

暂无答案!

目前还没有任何答案,快来回答吧!

相关问题