Decompose Logstash json message into fields

前端 未结 4 1782
無奈伤痛
無奈伤痛 2021-02-01 21:46

It have a logfile that stores event with a timestamp and a json message. For example:

timestamp {\"foo\": 12, \"bar\": 13}

I would l

4条回答
  •  陌清茗
    陌清茗 (楼主)
    2021-02-01 22:03

    Try the latest logstash 1.2.1 and use codec value to parse json events directly.

    input {
        file {
            type => "tweetfile"
            path => ["/home/nikhil/temp/feed/*.txt"]
            codec => "json"
        }
    }
    filter{
        json{
            source => "message"
            target => "tweet"
        }
    }
    output {
        stdout { }
        elasticsearch { embedded => true }
    }
    

提交回复
热议问题