在Logstash中分解json數組字符串

Question

我有一個RabbitMQ以JSON格式發送3個字段，它正在被Logstash rabbitmq輸入插件使用。

其中一個字段是一個字符串JSON數組如下：

"content": [ 
    "1111", 
    "2222222", 
    "Test 06", 
    "3", 
    "3232", 
    "SomeValue1" 
] 

1. 我怎麼能有這樣的字符串每次進入一個領域，這樣我可以快速發現並從Kibana可視化可用的字段？現在我看到那個完整字符串的「內容」。

2. JSON數組字符串大小根據另一個字段eventID而變化。根據eventID，是否可以將該字符串中的值動態映射到特定名稱？ 如：

   "eventID": 1, 
       "content": [ 
       "name1": "1111", 
       "name2": "2222222", 
       "name3": "Test 06", 
       "name4": "3", 
       "name5": "3232", 
       "name6": "SomeValue1" 
   ] 
   
   "eventID": 2, 
       "content": [ 
       "othername1": "3434", 
       "othername2": "Test 10", 
       "othername3": "876", 
       "othername4": "Some String7" 
   ] 
   

我想有名字*和*英文別名在可用字段。 任何幫助，將不勝感激。

Answer 1

首先，我將假設您的輸入已經被正確解析爲一個數組了。出於測試目的，這意味着這樣的：

echo '{"eventID":1,"content":["a","b","c","d"]}' | bin/logstash -f test.conf 

其中test.conf是：

input { 
    stdin { codec => json } 
} 
output { 
    stdout { codec => rubydebug } 
} 

將輸出這樣的：

{ 
     "eventID" => 1, 
    "@timestamp" => 2017-08-03T19:39:13.054Z, 
     "@version" => "1", 
      "host" => "xxxxxx.local", 
     "content" => [ 
     [0] "a", 
     [1] "b", 
     [2] "c", 
     [3] "d" 
    ] 
} 

如果是這樣的話，那麼你就需要做這樣的事情：

filter { 
    if [eventID] == 1 { 
     mutate { 
      add_field => { 
       "eventName" => "type1 event" 
       "one0" => "%{[content][0]}" 
       "one1" => "%{[content][1]}" 
       "one2" => "%{[content][2]}" 
       "one3" => "%{[content][3]}" 
      } 
      remove_field => [ "content" ] 
     } 
    } else if [eventID] == 2 { 
     mutate { 
      add_field => { 
       "eventName" => "type2 event" 
       "two0" => "%{[content][0]}" 
       "two1" => "%{[content][1]}" 
       "two2" => "%{[content][2]}" 
       "two3" => "%{[content][3]}" 
      } 
      remove_field => [ "content" ] 
     } 
    } 
} 

which將生成如下事件：

{ 
     "eventID" => 1, 
    "@timestamp" => 2017-08-03T19:51:02.946Z, 
     "@version" => "1", 
      "host" => "xxxxxxx.local", 
      "one2" => "c", 
    "eventName" => "type1 event", 
      "one3" => "d", 
      "one0" => "a", 
      "one1" => "b" 
}