Logstash不解析json

当我在Kibana中看到结果时,我发现JSON中没有字段,更多message字段只包含字段"status" : "FAILED".

是否有可能从json解析字段并在Kibana中显示它们？我有以下配置:

input {
  file {
    type => "json"
    path => "/home/logstash/test.json"
    codec => json
    sincedb_path => "/home/logstash/sincedb"
  }
} 

output {
  stdout {}
  elasticsearch {
    protocol => "http"
    codec => "json"
    host => "elasticsearch.dev"
    port => "9200"
  }
}

并遵循JSON文件:

[{"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,"stop":1419621640491,"duration":17309},"severity":"NORMAL","status":"FAILED"},{"uid":"a88c89b377aca0c9","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,"stop":1419621640634,"duration":17452},"severity":"NORMAL","status":"FAILED"},{"uid":"32c3f8b52386c85c","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623185,"stop":1419621640826,"duration":17641},"severity":"NORMAL","status":"FAILED"}]

stringy05.. 18

是.你需要在你的配置中添加一个过滤器,就像这样.

filter{
    json{
        source => "message"
    }
}

这里的文档很好地描述了它

编辑 json编解码器似乎不喜欢传入数组.单个元素与此配置一起使用:

输入:

{"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,       "stop":1419621640491,"duration":17309      },      "severity":"NORMAL",      "status":"FAILED"   }

Logstash结果:

{
      "message" => "{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }",
     "@version" => "1",
   "@timestamp" => "2015-02-26T23:25:12.011Z",
         "host" => "emmet.local",
          "uid" => "441d1d1dd296fe60",
         "name" => "test_buylinks",
        "title" => "Testbuylinks",
         "time" => {
          "start" => 1419621623182,
           "stop" => 1419621640491,
       "duration" => 17309
   },
     "severity" => "NORMAL",
       "status" => "FAILED"

}

现在有一个数组:

输入

[{"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,       "stop":1419621640491,"duration":17309      },      "severity":"NORMAL",      "status":"FAILED"   }, {"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,       "stop":1419621640491,"duration":17309      },      "severity":"NORMAL",      "status":"FAILED"   }]

结果:

Trouble parsing json {:source=>"message", :raw=>"[{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }, {\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }]", :exception=>#, :level=>:warn}
{
      "message" => "[{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }, {\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }]",
     "@version" => "1",
   "@timestamp" => "2015-02-26T23:28:21.195Z",
         "host" => "emmet.local",
         "tags" => [
       [0] "_jsonparsefailure"
   ]
}

这看起来像编解码器中的错误,您可以将消息更改为对象而不是数组吗？

1> stringy05..：

---

是.你需要在你的配置中添加一个过滤器,就像这样.

filter{
    json{
        source => "message"
    }
}

这里的文档很好地描述了它

编辑 json编解码器似乎不喜欢传入数组.单个元素与此配置一起使用:

输入:

{"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,       "stop":1419621640491,"duration":17309      },      "severity":"NORMAL",      "status":"FAILED"   }

Logstash结果:

{
      "message" => "{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }",
     "@version" => "1",
   "@timestamp" => "2015-02-26T23:25:12.011Z",
         "host" => "emmet.local",
          "uid" => "441d1d1dd296fe60",
         "name" => "test_buylinks",
        "title" => "Testbuylinks",
         "time" => {
          "start" => 1419621623182,
           "stop" => 1419621640491,
       "duration" => 17309
   },
     "severity" => "NORMAL",
       "status" => "FAILED"

}

现在有一个数组:

输入

[{"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,       "stop":1419621640491,"duration":17309      },      "severity":"NORMAL",      "status":"FAILED"   }, {"uid":"441d1d1dd296fe60","name":"test_buylinks","title":"Testbuylinks","time":{"start":1419621623182,       "stop":1419621640491,"duration":17309      },      "severity":"NORMAL",      "status":"FAILED"   }]

结果:

Trouble parsing json {:source=>"message", :raw=>"[{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }, {\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }]", :exception=>#, :level=>:warn}
{
      "message" => "[{\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }, {\"uid\":\"441d1d1dd296fe60\",\"name\":\"test_buylinks\",\"title\":\"Testbuylinks\",\"time\":{\"start\":1419621623182,       \"stop\":1419621640491,\"duration\":17309      },      \"severity\":\"NORMAL\",      \"status\":\"FAILED\"   }]",
     "@version" => "1",
   "@timestamp" => "2015-02-26T23:28:21.195Z",
         "host" => "emmet.local",
         "tags" => [
       [0] "_jsonparsefailure"
   ]
}

这看起来像编解码器中的错误,您可以将消息更改为对象而不是数组吗？

---

似乎他们都知道它,源代码:#TODO(sissel):注意,这不会成功处理json列表#就像你的文本是&＃39;[1,2,3]&＃39;JSON.parse给你一个数组(正确) )#不会合并为哈希.如果有人需要这个,我们可以稍后解决它.