如何通過使用logstash索引json文件？

Question

我嘗試使索引如下所示的json文件。 我必須寫一個騙子的表情。 但是我不能那樣做嗎？ 你能幫助我嗎？

 {"level":"Information","ClientIP":"10.201.21.188","Test":"10.210.21.188"} {"level":"Information","ClientIP":"10.202.21.187","Test":"10.220.21.188"} {"level":"Information","ClientIP":"10.203.21.186","Test":"10.230.21.188"} {"level":"Information","ClientIP":"10.204.21.185","Test":"10.240.21.188"} 

我的logstash.conf如下：

 input { file { type => "json" path => ["C:/logs/test-20170933.json"] start_position => "beginning" } } filter { grok { match => [ "message","%{WORD:level} I HAVE TO WRITE OTHER ELEMENTS BUT HOW????"] } json { source => "message" } } output { stdout { codec => rubydebug } elasticsearch { hosts => [ "localhost:9200" ] index => "logstash-%{+YYYY.MM.dd}" } } 

我想我們需要表達諷刺意味才能做到這一點。 我也願意為此尋求新的創意解決方案。

Answer 1

您不需要做任何事情，您的file輸入只需要一個JSON編解碼器就可以了：

input {
  file {
    type => "json"
    path => ["C:/logs/test-20170933.json"]
    start_position => "beginning"
    codec => "json"                  <-- add this
  }
}
filter {
}
output {
    stdout {
        codec => rubydebug
    }
    elasticsearch {
        hosts => [ "localhost:9200" ]
        index => "logstash-%{+YYYY.MM.dd}"
    }
}