logstash kafka使用不同的编解码器输入了多个主题

Question

this is my logstash conf

input {
  kafka {
    bootstrap_servers => "127.0.0.1:9092"
    topics => ["filebeat", "access"]
    group_id => "test-consumer-group"
    consumer_threads => 1
    decorate_events => true
  }
}

I have two topics but I want to use different codec for diffrent topic. how can I do this?

I try to add

    if ([topic] == "filebeat") {
      codec => "json"
    }

in the kafka input conf, the the logstash returns me errors.

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 6, column 8 (byte 143) after input {\n  kafka {\n    bootstrap_servers => \"127.0.0.1:9092\"\n    topics => [\"filebeat\", \"access\"]\n    group_id => \"test-consumer-group\"\n    if "

Answer 1

You can create 2 separate kafka inputs with each a different codec.

One other option is to add a filter that parses the json object depending on the the topic

filter {
  if([topic] == "filebeat") {
    json {
      source => "message"
    }
  }
}

for more info check: https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html