要不要再翻翻文档呢?

Logstash如何解析多层嵌套json数据!!!

Logstash | 作者 liuzhanjiang | 发布于2019年08月22日 | 阅读数:3850

 
=====样例数据如下========
{    "systime":"2019/08/02 14:22:32",
    "apiName":"BFPLAT.POS.GET.ORDER.INFO",
    "executeTime":116.55720000000001,
    "verifycode":"8665398EFAD518480A30F689507D13A8",
    "signature":"068138f5-de25-4bdd-839a-ff5d4ab0a53f",
    "clientIP":"47.92.69.82:60704",
    "isRequest":1,
    "appKey":"BFPLAT",
    "IsError":0,
    "content":{
        "RetCode":0,
        "RetMsg":"success",
        "TimeSamp":"2019-08-02 14:22:32",
        "Signature":"068138f5-de25-4bdd-839a-ff5d4ab0a53f",
        "Data":{ "storeId": "5", "cashierNo": "211", "flowNo": 5552, "cashierNoOld": "", "flowNoOld": 0, "saleTime": "2019-08-02T11:49:35", "totalMoney": 2180, "totalCount": null, "personID": "2068", "vipid": 0, "vipType": null, "goodsList": [ { "id": "1168", "inx": "0", "name": "四季宝柔滑花生酱", "barcode": "6922877745386", "count": "1", "price": 2180, "amount": 2180, "discount": 0, "preferentialAmount": 0, "bulkType": "0", "code": "05001168", "discList": null } ], "payList": [ { "id": "1", "name": "现金", "type": "0", "money": 2180, "extraMoney": 0 } ], "deliveryInfo": null }
    }
}
 
1.content内容可能有值,可能没有值
2.content里的Data数据字段内容不固定
 
现希望通过logstash可以动态解析这个日志,扁平化处理,还请各位大神指导,如何可以实现?
已邀请:

Reilee - 在日devops

赞同来自:

如果是合法的 json,`codec => json` 就可以,不需要额外的解析。
楼主的问题在于数据,Data 字段的值多包了一层引号

要回复问题请先登录注册