有没有办法在fluentd中过滤出嵌套的JSON字符串到单独的字段中?
当前JSON:
{
Value1: "something",
Value2: "something",
Message:{
Value3: "Something",
Value3: "Something"
}
}
我想要的(或类似的东西):
{
Value1: "something",
Value2: "something",
Message.Value3: "Something",
Message.Value3: "Something"
}
JSON不必像上面的示例那样被展平,但我确实希望当这些值到达elasticsearch时,它们位于各自独立的字段(列)中。在其他方面,我希望将单个长消息字符串拆分为其中包含的多个字段。
发布于 2020-09-28 19:54:07
试试这个:
<source>
...
</source>
<filter myapp**>
@type parser
key_name Message
format multi_format
<pattern>
format json # try parsing json in the first place
</pattern>
<pattern>
format none # leave as is if this is not json (plaintext)
</pattern>
reserve_data true # keep the original Message field in case anything go wrong
</filter>
<match myapp**>
...
</match>
多格式解析器:https://github.com/repeatedly/fluent-plugin-multi-format-parser
https://stackoverflow.com/questions/64105238
复制