1. 程式人生 > >用 logstash 解析 json 陣列

用 logstash 解析 json 陣列

原始輸入日誌檔案每行日誌格式如下,json 陣列格式的:
[{“a”:1},{“a”:2}]

要求拆分成2行事件,在ES中儲存兩個文件
{“a”:1}
{“a”:2}

本來以為挺麻煩,原來 input -> codec => json 直接支援解析這種格式,真愚昧啊

    file {
        type => "test"
        path => "/home/jfy/tmp/test.txt"
        sincedb_path => "/home/jfy/soft/logstash-2.0.0/test.access"
        start_position => "beginning"
codec => json }

codec json:
This codec may be used to decode (via inputs) and encode (via outputs) full JSON messages. If the data being sent is a JSON array at its root multiple events will be created (one per element).