elasticsearch - logstash输入jdbc如何填充多值字段？

Question

我可以tagids像这样放置一个具有多值字段的文档，但是如何使用logstash输入jdbc填充具有多值的字段。

PUT /song/_doc/0
{
  "artist_name":"test",
  "artistid":0,
  "categories":[4,5,6],
  "created_at":"2021-12-13T00:00:00Z",
  "name":"test",
  "name_pinyin":"csgq",
  "tagids":[1,2,3]
}

现在我使用 jdbc 配置，但它1,2,3作为一个关键字。如何使它成为一个数组？

input {
  jdbc {
    jdbc_driver_library => ""
    jdbc_driver_class => "com.mysql.jdbc.Driver"
    jdbc_connection_string => "jdbc:............."
    jdbc_user => ""
    jdbc_password => ""
    schedule => "* * * * *"
    statement => "SELECT songid,name,name_pinyin,artistid,artist_name,'1,2,3' as tagids, '4,5,6' as categories,create_at from song"
  }
}

标签： elasticsearchjdbclogstash

Answer 1

您可以利用mutate/split过滤器来实现您想要的：

filter {
  mutate {
     split => { 
        "categories" => "," 
        "tagids" => "," 
     }
  }
}