用 logstash 解析 json 陣列
阿新 • • 發佈:2019-01-01
原始輸入日誌檔案每行日誌格式如下,json 陣列格式的:
[{“a”:1},{“a”:2}]
要求拆分成2行事件,在ES中儲存兩個文件
{“a”:1}
{“a”:2}
本來以為挺麻煩,原來 input -> codec => json 直接支援解析這種格式,真愚昧啊
file {
type => "test"
path => "/home/jfy/tmp/test.txt"
sincedb_path => "/home/jfy/soft/logstash-2.0.0/test.access"
start_position => "beginning"
codec => json
}
codec json:
This codec may be used to decode (via inputs) and encode (via outputs) full JSON messages. If the data being sent is a JSON array at its root multiple events will be created (one per element).