解析json格式时,filter插件的定义:
filter{
json{
source => "message"
target => "jsoncontent"
}
}
运行结果:
{
“@version”:1,
“@timestamp":"2019-03-01T09:12:12.123Z"
"host": "localhost"
"message": "{\"uid\":1234, \"type\":\"test\"}",
"jsoncontent":{
"uid": 1234,
"type": "test"
}
}
如果想在顶级结构下生成对应的字段,去掉filter插件中的target这个设置,如下所示:
filter{
json{
source => "message"
}
}
去掉后的运行结果:
{
“@version”:1,
“@timestamp":"2019-03-01T09:12:12.123Z"
"host": "localhost"
"message": "{\"uid\":1234, \"type\":\"test\"}",
"uid": 1234,
"type": "test"
}