当我尝试为数组传递更深层次的引用时，Split 似乎会引发错误

Question

我有一些简单的代码：

{ "bustime-response": { "vehicle": [ {"vid": "foo"}] }}

当我尝试运行我设置的 conf 文件时，它会崩溃。我认为这与拆分字段要求有关，但我不确定发生了什么。

split {
  field => "[bustime-response][vehicle]"
}

删除拆分时，系统将记录完整的 json 对象，但我试图为每个“车辆”创建单独的事件，而每个 'vehicle' 都有一个 'vid' 作为主键，因为一条路线上可能有多辆车。

我在处理 JSON 时是不是遗漏了什么？我正在查看 split 的文档，字段的信息是：

The field which value is split by the terminator. Can be a multiline message or the ID of an array. Nested arrays are referenced like: "[object_id][array_id]"

我的 docker 容器中的日志是：

[ERROR] 2020-10-12 19:14:14.450 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], \"#\", \"input\", \"filter\", \"output\" at line 12, column 1 (byte 270) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:183:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:44:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357:in `block in converge_state'"]}
[INFO ] 2020-10-12 19:14:14.554 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2020-10-12 19:14:19.590 [LogStash::Runner] runner - Logstash shut down.

Answer 1

split，比如 mutate 需要存在于“filter”块中。它们不是独立的选项。

当我尝试为数组传递更深层次的引用时，Split 似乎会引发错误

Split seems to throw an error when I attempt to pass in a deeper reference for an array

logstash

elastic-stack