如何使用Logstash将json数组输入解析为基本json,并可以将其作为输入发送给Loki进行可视化

vnjpjtjt  于 12个月前  发布在  Logstash
关注(0)|答案(1)|浏览(234)

输入-

[{"id": 23232, "user_name__v": "[email protected]", "data_type__v": "full__v", "token_id__v": 43434, "last_login__v": "2023-10-18T09:19:41.000Z", "active__v": true, "profile_type__v": "us_document_bulk_action_users_with_creat__c"}, {"id": 17685499, "user_name__v": "[email protected]", "data_type__v": "full__v", "token_id__v": 566, "last_login__v": "2023-10-18T09:18:56.000Z", "active__v": true, "profile_type__v": "busineess"}, {"id": 343434, "user_name__v": "[email protected]", "data_type__v": "full__v", "token_id__v": 37431, "last_login__v": "2023-11-01T07:39:00.000Z", "active__v": true, "profile_type__v": "it_actions__c"}]

字符串
配置文件筛选器-

filter {
  json {
    source => "message"
    target => "message"
  }
  mutate {
    add_field => {
      "app" => "TestingApp"
      "job" => "cronData"
    }
  }  
  mutate {
    remove_field => [ "event" ]
  }  
}


我无法将这个json数组转换为json对象,我试图拆分它,但没有按预期工作。
Desired Output:JSON格式,可在Loki中使用基本转换创建表数据/时间序列。
我试着分开,但没有预期的效果。

mu0hgdu0

mu0hgdu01#

您只需要在输入上应用JSON过滤器

filter {
    json {
        source => "array_input"
        target => "parsed_array"
        remove_field => "array_input"
    }
    ruby {
        code => "event.get('parsed_array').each { |kv| event.set(kv['Field'], kv['Value']) }"
    }
}

字符串

相关问题