身安不如心安,屋宽不如心宽 。

在logstash的 filter 中 嵌套型json 用 grok 、或者ruby 应该怎么写?

Logstash | 作者 PhoebM | 发布于2018年02月26日 | 阅读数:2849


 2018-02-25 16:18:42[ INFO ]{"behaviouralAnalysisDataEntityList":[{"btnNameList":["bet1","ben2"],"enterDivMsgEntity":[{"divClass":"DIVclass","divContent":"divContent","divTitle":"divTitle","enterTime":"Sun Feb 25 16:18:42 CST 2018"}],"webmoduleName":"考评","webmoduleNameAndWebPageName":"武","webpageName":"文件管理"}],"broserCookieEnabled":true,"broserLanguage":"en-ch","broserPlatform":"win32","browserDomain":"域名","browserHeight":"200","browserName":"谷歌","browserReferrer":"http://localhost:4200","browserWidth":"100","userId":"mjx","userName":"mjxName"}
这个 用grok 或者ruby 应该怎么写,给个思路也好 
 
已邀请:

strglee - 公众号: 每日ELK ,每天分享ELK相关知识

赞同来自: PhoebM muou

filter {
grok {
match => {
"message" => "%{DATESTAMP:created_time}\[ %{WORD:error_info} \](?<json_data>[.\s\S]+)"
}
}
json {
source => "json_data"
}
}
https://github.com/elastic/log ... terns

要回复问题请先登录注册