如何为json输入文件编写日志存储配置

pbwdgjma  于 2021-06-14  发布在  ElasticSearch
关注(0)|答案(0)|浏览(194)

我在下面添加了json文件,我正在尝试使用logstash conf文件从json数据生成字段。请建议我如何写配置创建ElasticSearch个别领域。

  1. enter code here
  2. "count": 15,
  3. "value": [
  4. {
  5. "_links": {
  6. "self": {
  7. "href": "hyperlink"
  8. },
  9. "web": {
  10. "href": "hyperlink"
  11. },
  12. "pipeline.web": {
  13. "href": "hyperlink"
  14. },
  15. "pipeline": {
  16. "href": "hyperlink"
  17. }
  18. },
  19. "pipeline": {
  20. "url": "hyperlink",
  21. "id": 90,
  22. "revision": 4,
  23. "name": "Name",
  24. "folder": "\"
  25. },
  26. "state": "completed",
  27. "result": "succeeded",
  28. "createdDate": "2020-10-21T20:00:02.2490446Z",
  29. "finishedDate": "2020-10-21T20:11:17.5898951Z",
  30. "url": "hyperlink",
  31. "id": 6254,
  32. "name": "0.1.0-integration.1+47"
  33. },

我的日志存储配置是

  1. input {
  2. file {
  3. type => "json"
  4. start_position => "beginning"
  5. path => "/home/dataflow/example.json"
  6. sincedb_path => "/dev/null"
  7. codec => multiline {
  8. pattern => "^"
  9. negate => false
  10. what => "previous"
  11. auto_flush_interval => 2
  12. }
  13. }
  14. }
  15. filter {
  16. json {
  17. source => "message"
  18. }
  19. }

它像单个行一样存储索引作为消息。。
我的要求是将所有内容转换为字段
提前谢谢。

暂无答案!

目前还没有任何答案,快来回答吧!

相关问题