Logstash:如何拆分多行json对象并将_字段添加到kibana中?
我有下面的JSON数据,我需要的是将每个对象分割成单独的消息和add_字段,但在我当前的配置中,整个JSON都被放在一条消息中,我不确定我做错了什么,任何帮助或正确的方向都会非常有帮助Logstash:如何拆分多行json对象并将_字段添加到kibana中?,json,logstash,elastic-stack,logstash-configuration,Json,Logstash,Elastic Stack,Logstash Configuration,我有下面的JSON数据,我需要的是将每个对象分割成单独的消息和add_字段,但在我当前的配置中,整个JSON都被放在一条消息中,我不确定我做错了什么,任何帮助或正确的方向都会非常有帮助 [ { "SOURCE": "Source A", "Model": "ModelABC", "Qty": "3" },
[
{
"SOURCE": "Source A",
"Model": "ModelABC",
"Qty": "3"
},
{
"SOURCE": "Source B",
"Model": "MoBC",
"Qty": "31"
},
{
"SOURCE": "Source C",
"Model": "MoBCSss",
"Qty": "3qq"
}
]
logstash.config
input {
file {
path => "/usr/share/logstash/sample-log/Test-Log-For-Kibana.json"
start_position => "beginning"
codec => multiline {
pattern => "^}"
negate => true what => previous auto_flush_interval => 1 multiline_tag => ""
}
}
}
filter {
json {
source => "message"
target => "someField"
}
mutate {
add_field => {
"SOURCE" => "%{[someField][SOURCE]}"
"Model" => "%{[someField][Model]}"
"Qty" => "%{[someField][Qty]}"
}
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => "elasticsearch:9200"
user => "elastic"
password => "changeme"
}
}