logstash filter 處理json資料按未經處理資料欄位資料存放區

標籤：logstash filter elk

以下是執行個體

未經處理資料：

{"countnum":2,"checktime":"2017-05-23 16:59:32"}

{"countnum":2,"checktime":"2017-05-23 16:59:32"}  

1、無涉及欄位類型轉換   logstash filter  配置如下參數即可

if [type] == "onlinecount" {

       json{

    source => "message"

     }

  }

2、涉及欄位類型轉換

logstash filter  

if [type] == "onlinecount" {

mutate{

split=>["message",","]

add_field => {

"coutnum" => "%{[message][0]}"

}

add_field => {

"checktime" => "%{[message][1]}"

}

remove_field => ["message"]

}

json{

source => "coutnum"

source => "checktime"

#convert => { "coutnum" => "integer" }

target => "coutnum"

target => "checktime"

}

}

本文出自 “BeingAWhole回憶積木小屋” 部落格，謝絕轉載！

logstash filter 處理json資料按未經處理資料欄位資料存放區