流利的，JSON 内的多级嵌套转义 JSON 字符串

Question

I'm trying to parse logs from third-party application - which I cannot change - in order to send it to elastic. Here is pseudo-code of log structure:

{
"field": "value",
"otherField" : "{\field\": {\"innerfield\":123123}}\r",
(...)
}

After this documentation and after attempt to use this plugin and many, many other solution, I've stack on it.

My goal is to have it in form:

{
"field": "value",
"otherField" : { 
   "field": {
     "innerfield":123123
    }
 }",
 (...)
}

Answer 1

Try followings:

<source>
  @type dummy
  tag dummy
  dummy [
    {"name": "value", "json": "{\"foo\": \"bar\", \"baz\": 1}"},
    {"name": "value", "json": "{\"foo\": \"bar\", \"baz\": 2}"},
    {"name": "value", "json": "{\"foo\": \"bar\", \"baz\": 3}"},
    {"name": "value", "json": "{\"foo\": \"bar\", \"baz\": 4}"},
    {"name": "value", "json": "{\"foo\": \"bar\", \"baz\": 5}"}
  ]
</source>

<filter dummy>
  @type parser
  key_name json
  reserve_data true
  remove_key_name_field true
  hash_value_field parsed
  <parse>
    @type json
  </parse>
</filter>

<match dummy>
  @type stdout
</match>

The result:

2019-04-09 12:19:35.042904619 +0900 dummy: {"name":"value","parsed":{"foo":"bar","baz":1}}
2019-04-09 12:19:36.044483191 +0900 dummy: {"name":"value","parsed":{"foo":"bar","baz":2}}
2019-04-09 12:19:37.046293186 +0900 dummy: {"name":"value","parsed":{"foo":"bar","baz":3}}
2019-04-09 12:19:38.048007580 +0900 dummy: {"name":"value","parsed":{"foo":"bar","baz":4}}

See the latest document: https://docs.fluentd.org/v1.0/articles/filter_parser#reserve_time