Logstash解析Json array

logstash解析json數組是一種常見的需求，我以網上一組數據爲例來描述

咱們的數據test.json內容以下：(此處我linux上的json文本須要是compact的)

{"type":"monitor","server":"10.111.222.333","host":"abc.de","bean":[{"name":"beanName1","reseted":"2015-06-05T15:10:00.192Z","method":[{"name":"getAllXY","count":5,"min":3,"max":5},{"name":"getName","count":4,"min":2,"max":4}]},{"name":"beanName2","reseted":"2015-06-05T15:10:00.231Z","method":[{"name":"getProperty","count":4,"min":3,"max":3}]},{"name":"beanName3","reseted":"2015-06-05T15:10:00.231Z"}]}

爲了方便看清楚內容，咱們format後查看：

{
"type": "monitor",
"server": "10.111.222.333",
"host": "abc.de",
"bean": [{
    "name": "beanName1",
    "reseted": "2015-06-05T15:10:00.192Z",
    "method": [{
      "name": "getAllXY",
      "count": 5,
      "min": 3,
      "max": 5
    },
    {
      "name": "getName",
      "count": 4,
      "min": 2,
      "max": 4
    }]
  },
  {
    "name": "beanName2",
    "reseted": "2015-06-05T15:10:00.231Z",
    "method": [{
      "name": "getProperty",
      "count": 4,
      "min": 3,
      "max": 3
    }]
  },
  {
    "name": "beanName3",
    "reseted": "2015-06-05T15:10:00.231Z"
  }]
}

咱們能夠看到bean字段下是一個json數組，解析這種json數組，咱們須要借用logstash split filter plugin

測試：單純地把bean字段下的json拆分出來

個人配置文件以下

input {
        file {
            path => "/usr/share/logstash/private.cond/split.json"
            codec => "json"
            start_position => "beginning"
            sincedb_path => "/dev/null"
        }
}
filter {
         json {
            source => "message"
         }
         split {
            field => "bean"
         }
}
 
output {
        stdout {
            codec => rubydebug
        }
}

咱們獲得以下輸出結果

{
      "@version" => "1",
        "server" => "10.111.222.333",
          "type" => "monitor",
          "bean" => {
           "name" => "beanName1",
         "method" => [
            [0] {
                  "min" => 3,
                 "name" => "getAllXY",
                "count" => 5,
                  "max" => 5
            },
            [1] {
                  "min" => 2,
                 "name" => "getName",
                "count" => 4,
                  "max" => 4
            }
        ],
        "reseted" => "2015-06-05T15:10:00.192Z"
    },
          "path" => "/usr/share/logstash/private.cond/split.json",
    "@timestamp" => 2018-08-02T10:36:21.248Z,
          "host" => "abc.de"
}
{
      "@version" => "1",
        "server" => "10.111.222.333",
          "type" => "monitor",
          "bean" => {
           "name" => "beanName2",
         "method" => [
            [0] {
                  "min" => 3,
                 "name" => "getProperty",
                "count" => 4,
                  "max" => 3
            }
        ],
        "reseted" => "2015-06-05T15:10:00.231Z"
    },
          "path" => "/usr/share/logstash/private.cond/split.json",
    "@timestamp" => 2018-08-02T10:36:21.248Z,
          "host" => "abc.de"
}
{
      "@version" => "1",
        "server" => "10.111.222.333",
          "type" => "monitor",
          "bean" => {
        "reseted" => "2015-06-05T15:10:00.231Z",
           "name" => "beanName3"
    },
          "path" => "/usr/share/logstash/private.cond/split.json",
    "@timestamp" => 2018-08-02T10:36:21.248Z,
          "host" => "abc.de"
}

根據輸出咱們能夠看到json數組被我單個拆分出來。