不要急,总有办法的

logstash-6.5.4 ruby脚本获取JSON字段值

Logstash | 作者 xminj | 发布于2020年08月07日 | 阅读数:2725

利用lostash ruby脚本计算时间业务请求的时间差,通过event.get('field') ,发现获取不到值。
 
 
logstash 报错信息:
Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"log-2020.08.07", :routing=>nil, :_type=>"_doc"}, #<LogStash::Event:0x77f583a>], :response=>{"index"=>{"_index"=>"log-2020.08.07", "_type"=>"_doc", "_id"=>"PRivxnMBu29pQhrLCUqW", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"object mapping for [backendResponseTime] tried to parse field [backendResponseTime] as object, but found a concrete value"}}}}
 
logstash 配置文件中ruby代码:
 ruby {
                        #invokeDate = event.get('invokeDate');  #转调时间
                        #invokeResDate = event.get('invokeResDate');  # 业务返回时间
                        #backendResponseTime  后端耗时
                        code => "
                                funcCode=event.get('domainname')
                                event.set('backendResponseTime',funcCode)
                        "
                }
 
kibana :
{
    "_index":"log-2020.08.07",
    "_type":"_doc",
    "_id":"8hipxnMBu29pQhrLjydO",
    "_version":1,
    "_score":null,
    "_source":{
        "@version":"1",
        "resDate":"2020-08-07T09:38:05.301+08:00",
        "@timestamp":"2020-08-07T02:04:21.330Z",
        "recvDate":"2020-08-07T09:38:05.301+08:00",
        "sysCode":"code",
        "iPAddress":"1111111",
        "proxy":"kli",
        "response":"failed",
        "backendResponseTime":null,
        "domainname":"1111",
        "resReason":"成都成都成都",
        "type":"LIUY",
        "callMethod":"CMMMM",
        "resResult":"LLLLLL"
    },
    "fields":{
        "resDate":[
            "2020-08-07T01:38:05.301Z"
        ],
        "@timestamp":[
            "2020-08-07T02:04:21.330Z"
        ],
        "recvDate":[
            "2020-08-07T01:38:05.301Z"
        ]
    },
    "sort":[
        1596765861330
    ]
}
已邀请:

要回复问题请先登录注册