时间戳

首页 > 解决方案 > 如何解析值中的json对象

logstash - 如何解析值中的json对象

问题描述

我在日志文件中记录了 JSON 中的记录：

{"created":1610314252.6277733,"process":13,"levelname":"INFO","message":"Requesting url: http://smshost:8080/push with method: POST and params {'data': {'message': 'Record changed: go to:XXXX', 'resource_id': '1824908f-efae-474e-aa3e-579cabe67517', 'subscriber': '000000000000', 'service': 'SERVICE'}, 'json': None}","message_id":268562185}

Filebeat 将此数据发送到 logstash

filebeat.prospectors:
- paths:
   - /opt/apps/mobilizer/*.log
  input_type: log
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: log

输出数据：

{
    "@timestamp":"2021-01-11T09:53:48.062Z",
    "@metadata":{"beat":"filebeat","type":"doc","version":"6.8.13"},
    "levelname":"INFO",
    "source":"/opt/apps/mobilizer/logs/test.json",
    "offset":114,
    "message":"Requesting url: http://smshost:8080/push with method: POST and params {'data': {'message': 'Record changed: go to:XXXX', 'resource_id': '1824908f-efae-474e-aa3e-579cabe67517', 'subscriber': '000000000000', 'service': 'SERVICE'}, 'json': None}",
    "beat":{"name":"skif-HP-240-G7-Notebook-PC","hostname":"skif-HP-240-G7-Notebook-PC","version":"6.8.13"},
    "host":{"name":"skif-HP-240-G7-Notebook-PC"},
    "message_id":268562185,
    "error":{"message":"Key 'log' not found","type":"json"},
    "log":{"file":{"path":"/opt/apps/mobilizer/logs/test.json"}},
    "process":13,"created":1.6103142526277733e+09
}

但我想解析“消息”并在“paran”之后获取字典数据。（在 logstash 或 filebeat 中）：

{
    ...
    "message":"Requesting url: http://smshost:8080/push with method: POST and params ",
    "data": {"message": "Record changed: go to:XXXX", "resource_id": "1824908f-efae-474e-aa3e-579cabe67517', "subscriber": "000000000000', "service": "SERVICE"}, 
    "json": "None",
    ...
}

我怎样才能做到这一点？在 logstash 或 filebeat 中哪个更好？

标签： logstashfilebeat

解决方案

推荐阅读