filebeat进行json解析之前能够替换被解析的字符串中的字符吗?

Beats | 作者 Atom | 发布于2019年01月23日 | 阅读数:125

{"@timestamp":"2019-01-23T11:39:06+08:00","remote_addr":"172.16.254.12","remote_user":"-","request":"POST /zabbix/jsrpc.php?output=json-rpc HTTP/1.1","request_body":"{\x22jsonrpc\x22: \x222.0\x22, \x22method\x22: \x22zabbix.status\x22, \x22params\x22: {}, \x22id\x22: 31167}","size":77,"request_time":0.046,"upstream_response_time":"0.046","upstream_addr":"192.9.70.12:80","http_host":"fastmap.navinfo.com","server_addr":"192.168.3.180","http_x_forwarded_for":"-","http_referer":"http://fastmap.navinfo.com/zab ... ot%3B,"http_user_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36","status":200}
 
 
我要使用filebeat进行收集的日志如上,里面包含\x22,我想将所有的\x22替换为空格,请问需要在filebeat中怎么设置呢?
已邀请:

Atom - beat-logstash-elasticsearch-kabana

赞同来自:

这个已经找到解决方案了,使用filebeat将日志原文转到logstash,不做json解析;然后在logstash中做字符替换,然后再解析json。
 
具体logstash中的配置如下:
 
filter {
mutate {
gsub =>[
"message", "\\x22", ''
]
}
json {
source => "message"
remove_field => ["message"]
}
}

要回复问题请先登录注册