我在下面添加了json文件,我正在尝试使用logstash conf文件从json数据生成字段。请建议我如何写配置创建ElasticSearch个别领域。
enter code here
"count": 15,
"value": [
{
"_links": {
"self": {
"href": "hyperlink"
},
"web": {
"href": "hyperlink"
},
"pipeline.web": {
"href": "hyperlink"
},
"pipeline": {
"href": "hyperlink"
}
},
"pipeline": {
"url": "hyperlink",
"id": 90,
"revision": 4,
"name": "Name",
"folder": "\"
},
"state": "completed",
"result": "succeeded",
"createdDate": "2020-10-21T20:00:02.2490446Z",
"finishedDate": "2020-10-21T20:11:17.5898951Z",
"url": "hyperlink",
"id": 6254,
"name": "0.1.0-integration.1+47"
},
我的日志存储配置是
input {
file {
type => "json"
start_position => "beginning"
path => "/home/dataflow/example.json"
sincedb_path => "/dev/null"
codec => multiline {
pattern => "^"
negate => false
what => "previous"
auto_flush_interval => 2
}
}
}
filter {
json {
source => "message"
}
}
它像单个行一样存储索引作为消息。。
我的要求是将所有内容转换为字段
提前谢谢。
暂无答案!
目前还没有任何答案,快来回答吧!