Logstash Merge Field With Root Object

问题

I have logstash input that looks like this

{
    "@timestamp": "2016-12-20T18:55:11.699Z",
    "id": 1234,
    "detail": {
        "foo": 1
        "bar": "two"
    }
}

I would like to merge the content of "detail" with the root object so that the final event looks like this:

{
    "@timestamp": "2016-12-20T18:55:11.699Z",
    "id": 1234,
    "foo": 1
    "bar": "two"
}

Is there a way to accomplish this without writing my own filter plugin?

回答1:

You can do this with a ruby filter.

filter { ruby { code => " event['detail'].each {|k, v| event[k] = v } event.remove('detail') " } }

回答2:

There is a simple way to do that using the json_encode plugin (not included by default).

The json extractor add fields to the root of the event. It's one of the very few extractors that can add things to the root.

filter {
    json_encode {
        source => "detail"
        target => "detail"
    }

    json {
        source => "detail"
        remove_field => [ "detail" ]
    }
}

来源：https://stackoverflow.com/questions/41251703/logstash-merge-field-with-root-object