json - Logstash：如何将多行 json 对象和 add_field 拆分为 kibana？

Question

我有以下 JSON 数据，我需要将每个对象拆分为单独的消息和 add_filed，但是根据我当前的配置，整个 JSON 正在变成一条消息，我不确定我做错了什么，任何帮助或正确的方向将非常有帮助。

[
    {
        "SOURCE": "Source A",
        "Model": "ModelABC",
        "Qty": "3"
    },
    {
        "SOURCE": "Source B",
        "Model": "MoBC",
        "Qty": "31"
    },
    {
        "SOURCE": "Source C",
        "Model": "MoBCSss",
        "Qty": "3qq"
    }
]

logstash.config

    input {
  file {
    path => "/usr/share/logstash/sample-log/Test-Log-For-Kibana.json"
    start_position => "beginning"
    codec => multiline {
      pattern => "^}"
      negate => true what => previous auto_flush_interval => 1 multiline_tag => ""
    }
  }
}

filter {

  json {
    source => "message"
    target => "someField"
  }

  mutate {
    add_field => {
      "SOURCE" => "%{[someField][SOURCE]}"
      "Model" => "%{[someField][Model]}"
      "Qty" => "%{[someField][Qty]}"
    }
  }
}

output {
  stdout {
    codec => rubydebug
  }

  elasticsearch {
    hosts => "elasticsearch:9200"
    user => "elastic"
    password => "changeme"
  }

}

标签： jsonlogstashelastic-stacklogstash-configuration