ilter-json：http://www.logstash.net/docs/1.4.2/filters/json
json数据：
{"account_number":995,"balance":21153,"firstname":"Phelps","lastname":"Parrish","age":25,"gender":"M","address":"666 Miller Place","employer":"Pearlessa","email":"phelpsparrish@pearlessa.com","city":"Brecon","state":"ME"}
logjson.conf文件：
input {
file {
type => "accounts"
path => "D:/logsystem/logstash/bin/test/accounts.txt"
start_position => "beginning"
}
}
filter {
json{
source => "message"
}
}
output {
stdout{
codec => rubydebug
}
#无法解析的json不记录到elasticsearch中
if "_jsonparsefailure" not in [tags] {
elasticsearch {
host => "localhost"
}
}
}结果如下：
View: Table / JSON / Raw
{
"_index": "logstash-2014.12.12",
"_type": "accounts",
"_id": "7LEXwMOPQp-FrvJrrRO6Yw",
"_score": 1,
"_source": {
"message": "{\"account_number\":903,\"balance\":10238,\"firstname\":\"Wade\",\"lastname\":\"Page\",\"age\":35,\"gender\":\"F\",\"address\":\"685 Waldorf Court\",\"employer\":\"Eplosion\",\"email\":\"wadepage@eplosion.com\",\"city\":\"Welda\",\"state\":\"AL\"}",
"@version": "1",
"@timestamp": "2014-12-12T14:22:30.109Z",
"type": "accounts",
"host": "huangwen",
"path": "D:/logsystem/logstash/bin/test/accounts.txt",
"account_number": 903,
"balance": 10238,
"firstname": "Wade",
"lastname": "Page",
"age": 35,
"gender": "F",
"address": "685 Waldorf Court",
"employer": "Eplosion",
"email": "wadepage@eplosion.com",
"city": "Welda",
"state": "AL"
}
}
原文 https://blog.51cto.com/hxw168/1589486