在Logstash中使用变量键名访问嵌套的JSON值

Question

I've got a question regarding JSON in Logstash. I have got a JSON Input that looks something like this:

{
"2": {
        "name": "name2",
        "state": "state2"
    },

"1": {
        "name": "name1",
        "state": "state1"
    },

"0": {
        "name": "name0",
        "state": "state0"
    }
}

Now, let's say I want to add a field in the logstash config

json{
    source => "message"
    add_field => {
            "NAME" => "%{ What to write here ?}"
            "STATE" => "%{ What to write here ?}"
    }
}

Is there a way to access the JSON Input such that I get a field Name with value name1, another field with name 2 and a third field with name 3. The first key in the JSON is changing, that means there can only be one or many more parts. So I don't want to hardcode it like

%{[0][name]}

Thanks for your help.

Answer 1

If you remove all new lines in your input you can simply use the json filter . You don't need any add_field action.

Working config without new lines:

filter {
        json { source => message }
}

If you can't remove the new lines in your input you need to merge the lines with the multiline codec .

Working config with new lines:

input {   
    file {
        path => ["/path/to/your/file"] # I suppose your input is a file.
        start_position => "beginning"
        sincedb_path => "/dev/null" # just for testing
        codec => multiline {
            pattern => "^}"
            what => "previous"
            negate => "true"
        }
    }
}

filter {
    mutate { replace => { "message" => "%{message}}" }  }
    json { source => message }
}

I suppose that you use the file input. In case you don't, just change it.

Output (for both):

"2" => {
     "name" => "name2",
    "state" => "state2"
},
"1" => {
     "name" => "name1",
    "state" => "state1"
},
"0" => {
     "name" => "name0",
    "state" => "state0"
}