从 RabbitMQ 解析 Logstash JSON

Question

我从 RabbitMQ 收到以下消息，我认为从 RabbitMQ 收到的 JSON 有 BOM

{"ID":"811b7858-a926-479f-939a-2b0ab17de855","Name":"Johnson","Age": "30", "Work":"Engineer","Timestamp":"4/13/2015 10:53:29 AM"}

当我将其保存到 Elastic 搜索中时，得到的结果如下：

{
"_index": "logstash-2015.04.13",
"_type": "logs",
"_id": "AUyxO4R8g98unoWRM4eU",
"_version": 1,
"_score": 1,
"_source": {
    "message": "{"ID":"811b7858-a926-479f-939a-2b0ab17de855",","Name":"Johnson","Age": "30", "Work":"Engineer","Timestamp":"4/13/2015 10:53:29 AM"}",
    "@version": "1",
    "@timestamp": "2015-04-13T05:23:29.935Z",
    "type": "Employees"
    }
}

但我希望它们被存储为

{
"_index": "logstash-2015.04.13",
"_type": "logs",
"_id": "AUyxO4R8g98unoWRM4eU",
"_version": 1,
"_score": 1,
"_source": {
    "ID":"811b7858-a926-479f-939a-2b0ab17de855",
    "Name":"Johnson",
    "Age": "30",
    "Work":"Engineer",
    "Timestamp":"4/13/2015 10:53:29 AM"
    "@version": "1",
    "@timestamp": "2015-04-13T05:23:29.935Z",
    "type": "Employees" 
    }
}

我试过json过滤器。 但它不起作用。

Answer 1

您可以尝试为 logstash 使用 json 过滤器，它将消息字符串转换为 json 格式

filter {
  json {
    source => "message"
    remove_field => ["message"]
  }
}