從 RabbitMQ 解析 Logstash JSON

Question

我從 RabbitMQ 收到以下消息，我認為從 RabbitMQ 收到的 JSON 有 BOM

{"ID":"811b7858-a926-479f-939a-2b0ab17de855","Name":"Johnson","Age": "30", "Work":"Engineer","Timestamp":"4/13/2015 10:53:29 AM"}

當我將其保存到 Elastic 搜索中時，得到的結果如下：

{
"_index": "logstash-2015.04.13",
"_type": "logs",
"_id": "AUyxO4R8g98unoWRM4eU",
"_version": 1,
"_score": 1,
"_source": {
    "message": "{"ID":"811b7858-a926-479f-939a-2b0ab17de855",","Name":"Johnson","Age": "30", "Work":"Engineer","Timestamp":"4/13/2015 10:53:29 AM"}",
    "@version": "1",
    "@timestamp": "2015-04-13T05:23:29.935Z",
    "type": "Employees"
    }
}

但我希望它們被存儲為

{
"_index": "logstash-2015.04.13",
"_type": "logs",
"_id": "AUyxO4R8g98unoWRM4eU",
"_version": 1,
"_score": 1,
"_source": {
    "ID":"811b7858-a926-479f-939a-2b0ab17de855",
    "Name":"Johnson",
    "Age": "30",
    "Work":"Engineer",
    "Timestamp":"4/13/2015 10:53:29 AM"
    "@version": "1",
    "@timestamp": "2015-04-13T05:23:29.935Z",
    "type": "Employees" 
    }
}

我試過json過濾器。 但它不起作用。

Answer 1

您可以嘗試為 logstash 使用 json 過濾器，它將消息字符串轉換為 json 格式

filter {
  json {
    source => "message"
    remove_field => ["message"]
  }
}