Logstash-连接两个dict
我写了一个小的工作示例来解释我的问题:Logstash-连接两个dict,logstash,Logstash,我写了一个小的工作示例来解释我的问题: input { stdin { codec => "json" } } filter { mutate { rename => { "[DictA]" => "[ZielDict]" } rename => { "[DictB]" => "[ZielDict]" } } } output { stdout {} } 输入 输出 { "@v
input {
stdin {
codec => "json"
}
}
filter {
mutate {
rename => { "[DictA]" => "[ZielDict]" }
rename => { "[DictB]" => "[ZielDict]" }
}
}
output {
stdout {}
}
输入
输出
{
"@version" => "1",
"host" => "78f85c66a671",
"@timestamp" => 2018-11-15T12:11:01.193Z,
"ZielDict" => {
"valueB" => 456
}
}
想要输出(我不想覆盖DictA!)
如您所见,我希望附加到ZielDict,而不是用DictB覆盖它。我该怎么办?
提前谢谢 使用以下选项:
通过此配置,您可以获得:
{
"host" => "frsred-0077",
"@timestamp" => 2018-11-15T13:54:19.923Z,
"DictA" => {
"valueB" => 456,
"valueA" => 123
},
"DictB" => {
"valueB" => 456
},
"@version" => "1"
}
您必须删除DictB
字段并重命名DictA
,以获得所需的输出
{
"@version" => "1",
"host" => "78f85c66a671",
"@timestamp" => 2018-11-15T12:11:01.193Z,
"ZielDict" => {
"valueA" => 123
"valueB" => 456
}
}
input {
stdin {
codec => "json"
}
}
filter {
mutate {
merge => { "DictA" => "DictB" }
}
}
output {
stdout {}
}
{
"host" => "frsred-0077",
"@timestamp" => 2018-11-15T13:54:19.923Z,
"DictA" => {
"valueB" => 456,
"valueA" => 123
},
"DictB" => {
"valueB" => 456
},
"@version" => "1"
}