【logstash】

ilter-json：http://www.logstash.net/docs/1.4.2/filters/json

json数据：

{"account_number":995,"balance":21153,"firstname":"Phelps","lastname":"Parrish","age":25,"gender":"M","address":"666 Miller Place","employer":"Pearlessa","email":"phelpsparrish@pearlessa.com","city":"Brecon","state":"ME"}

　　

logjson.conf文件：

input {
file {
  type => "accounts"
  path => "D:/logsystem/logstash/bin/test/accounts.txt"

start_position => "beginning"

}
}

filter {

    json{
	source => "message"
    
     }


}

output {
      stdout{
	codec => rubydebug
	}
#无法解析的json不记录到elasticsearch中
if "_jsonparsefailure" not in [tags] {
  elasticsearch {
    host => "localhost"
  }
}

}

 

结果如下：

View: Table / JSON / Raw
{
  "_index": "logstash-2014.12.12",
  "_type": "accounts",
  "_id": "7LEXwMOPQp-FrvJrrRO6Yw",
  "_score": 1,
  "_source": {
    "message": "{"account_number":903,"balance":10238,"firstname":"Wade","lastname":"Page","age":35,"gender":"F","address":"685 Waldorf Court","employer":"Eplosion","email":"wadepage@eplosion.com","city":"Welda","state":"AL"}",
    "@version": "1",
    "@timestamp": "2014-12-12T14:22:30.109Z",
    "type": "accounts",
    "host": "huangwen",
    "path": "D:/logsystem/logstash/bin/test/accounts.txt",
    "account_number": 903,
    "balance": 10238,
    "firstname": "Wade",
    "lastname": "Page",
    "age": 35,
    "gender": "F",
    "address": "685 Waldorf Court",
    "employer": "Eplosion",
    "email": "wadepage@eplosion.com",
    "city": "Welda",
    "state": "AL"
  }
}

原文 https://blog.51cto.com/hxw168/1589486