Json 联合国在基巴纳分析了一个领域

我有一个ELK堆栈，它从filebeat结构化JSON日志接收如下内容：

{"what": "Connected to proxy service", "who": "proxy.service", "when": "03.02.2016 13:29:51", "severity": "DEBUG", "more": {"host": "127.0.0.1", "port": 2004}}
{"what": "Service registered with discovery", "who": "proxy.discovery", "when": "03.02.2016 13:29:51", "severity": "DEBUG", "more": {"ctx": {"node": "igz0", "ip": "127.0.0.1:5301", "irn": "proxy"}, "irn": "igz0.proxy.827378e7-3b67-49ef-853c-242de033e645"}}
{"what": "Exception raised while setting service value", "who": "proxy.discovery", "when": "03.02.2016 13:46:34", "severity": "WARNING", "more": {"exc": "ConnectionRefusedError('Connection refused',)", "service": "igz0.proxy.827378e7-3b67-49ef-853c-242de033e645"}}

“more”字段是一个嵌套的JSON，在kibana中被分解为不同的字段（“more.host”、“more.ctx”等等）（不确定堆栈的哪个部分）

这是我的输入：

input {
  beats {
    port => 5044
  }
}
filter {
  if [type] == "node" {
    json {
      source => "message"
      add_field => {
        "who" => "%{name}"
        "what" => "%{msg}"
        "severity" => "%{level}"
        "when" => "%{time}"
      }
    }
  } else {
    json {
      source => "message"
    }
  }
  date {
    match => [ "when" , "dd.MM.yyyy HH:mm:ss", "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"]
  }
}

这是我的输出：

output {
  elasticsearch {
    hosts => ["localhost"]
    sniffing => true
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
  stdout { codec => rubydebug }
}

---

有没有办法创建一个包含整个“more”字段的字段而不将其拆分？

您应该能够使用ruby过滤器获取散列并将其转换回字符串

filter {
   ruby {
      code => "event['more'] = event['more'].to_s"
   }
}

---

您可能希望用

if

包围它，以确保该字段首先存在。

我应该在哪里添加此筛选器？在

输入{}

和

输出{}

之间的某个位置。。。很难说没有看到您的配置文件。