Logstash：拆分 json 对象

Question

拜托，我有一个 json 对象，它来自 xml 输入，它看起来像这样：

{
  "@version" => "1",
"@timestamp" => "2016-04-11T15:35:07.372Z",
      "host" => "YUSUF-PC",
   "command" => "nana",
       "doc" => {
    "TotalResults" => "1892",
           "Audit" => [
        [0] {
                    "Id" => "2260167",
                "Action" => "UPDATE",
              "ParentId" => "30612",
            "ParentType" => "defect",
                  "Time" => "2016-01-04 08:27:59",
                  "User" => "nana",
            "Properties" => {
                "Property" => [
                    [0] {
                           "Label" => "Statut",
                            "Name" => "status",
                        "NewValue" => [
                            [0] "En cours"
                        ]
                    },
                    [1] {
                           "Label" => "Affecté à",
                            "Name" => "owner",
                        "NewValue" => [
                            [0] "nana"
                        ]
                    },
                    [2] {
                           "Label" => "Priorité",
                            "Name" => "severity",
                        "NewValue" => [
                            [0] "nana"
                        ]
                    }
                ]
            }
        },
        [1] {
                    "Id" => "2260168",
                "Action" => "UPDATE",
              "ParentId" => "30612",
            "ParentType" => "defect",
                  "Time" => "2016-01-04 09:45:33",
                  "User" => "nana",
            "Properties" => {
                "Property" => [
                    [0] {
                           "Label" => "Affecté à",
                            "Name" => "owner",
                        "NewValue" => [
                            [0] "nana"
                        ],
                        "OldValue" => [
                            [0] "nana"
                        ]
                    }
                ]
            }
        }
    ]
} }

我需要将这个 json 拆分为属性，即让每个文档包含一个属性，问题不在于拆分操作，而是当我将其插入到 elasticsearch 时，"NewValue" 字段没有考虑在内...所以我需要编写一个 ruby 过滤器来将值更改为值 [0]。任何人都可以提供帮助，我不擅长 ruby ?

我想要一件像这样的 json :

{
  "@version" => "1",
"@timestamp" => "2016-04-11T15:35:07.372Z",
      "host" => "YUSUF-PC",
   "command" => "nana",
       "doc" => {
    "TotalResults" => "1892",
           "Audit" => [
        [0] {
                    "Id" => "2260167",
                "Action" => "UPDATE",
              "ParentId" => "30612",
            "ParentType" => "defect",
                  "Time" => "2016-01-04 08:27:59",
                  "User" => "nana",
            "Properties" => {
                "Property" => 
                    {
                           "Label" => "Statut",
                            "Name" => "status",
                        "NewValue" => "En cours"
                        }                            
                    }
                }

             ]
         }
       }

谢谢

Answer 1

希望对您有所帮助。

old = {
"@version" => "1",
"@timestamp" => "2016-04-11T15:35:07.372Z",
  "host" => "YUSUF-PC",
   "command" => "nana",
   "doc" => {
     "TotalResults" => "1892",
       "Audit" => [
       {
                "Id" => "2260167",
                "Action" => "UPDATE",
                "ParentId" => "30612",
                "ParentType" => "defect",
                "Time" => "2016-01-04 08:27:59",
                "User" => "nana",
                "Properties" => {
                  "Property" => [
                 {
                       "Label" => "Statut",
                       "Name" => "status",
                       "NewValue" => [
                        "En cours"
                    ]
                },
                 {
                       "Label" => "Affecté à",
                        "Name" => "owner",
                    "NewValue" => [
                         "nana"
                    ]
                },
                 {
                       "Label" => "Priorité",
                        "Name" => "severity",
                    "NewValue" => [
                         "nana"
                    ]
                }
            ]
        }
    },
     {
                "Id" => "2260168",
            "Action" => "UPDATE",
          "ParentId" => "30612",
        "ParentType" => "defect",
              "Time" => "2016-01-04 09:45:33",
              "User" => "nana",
        "Properties" => {
            "Property" => [
                 {
                       "Label" => "Affecté à",
                        "Name" => "owner",
                    "NewValue" => [
                         "nana"
                    ],
                    "OldValue" => [
                         "nana"
                    ]
                }
            ]
          }
      }
  ]
  } }

  ##THIS IS THE LINE ACTUALLY DOING WORK.
  old["doc"]["Audit"].map{|prop| prop["Properties"]["Property"].map{|value| value['NewValue']= value['NewValue'].first} }
  old
  => {"@version"=>"1", "@timestamp"=>"2016-04-11T15:35:07.372Z", "host"=>"YUSUF-PC", "command"=>"nana", "doc"=>{"TotalResults"=>"1892", "Audit"=>[{"Id"=>"2260167", "Action"=>"UPDATE", "ParentId"=>"30612", "ParentType"=>"defect", "Time"=>"2016-01-04 08:27:59", "User"=>"nana", "Properties"=>{"Property"=>[{"Label"=>"Statut", "Name"=>"status", "NewValue"=>"En cours"}, {"Label"=>"Affecté à", "Name"=>"owner", "NewValue"=>"nana"}, {"Label"=>"Priorité", "Name"=>"severity", "NewValue"=>"nana"}]}}, {"Id"=>"2260168", "Action"=>"UPDATE", "ParentId"=>"30612", "ParentType"=>"defect", "Time"=>"2016-01-04 09:45:33", "User"=>"nana", "Properties"=>{"Property"=>[{"Label"=>"Affecté à", "Name"=>"owner", "NewValue"=>"nana", "OldValue"=>["nana"]}]}}]}}

Logstash：拆分 json 对象

Logstash : Split json object

ruby

split

elasticsearch

logstash