重命名Logstash中的Json解析字段时出现问题
我正在Logstash中解析json日志文件。有一个名为@person.name的字段。在发送到elasticsearch之前,我尝试重命名此字段名。我还试图删除该字段,但无法删除该字段,因为我的数据在Elasticsearch中没有索引 弹性搜索中记录的错误重命名Logstash中的Json解析字段时出现问题,logstash,logstash-configuration,Logstash,Logstash Configuration,我正在Logstash中解析json日志文件。有一个名为@person.name的字段。在发送到elasticsearch之前,我尝试重命名此字段名。我还试图删除该字段,但无法删除该字段,因为我的数据在Elasticsearch中没有索引 弹性搜索中记录的错误 MapperParsingException[Field name [@person.name] cannot contain '.'] at org.elasticsearch.index.mapper.object.Objec
MapperParsingException[Field name [@person.name] cannot contain '.']
at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseProperties(ObjectMapper.java:276)
at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseObjectOrDocumentTypeProperties(ObjectMapper.java:221)
at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parse(ObjectMapper.java:196)
at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseProperties(ObjectMapper.java:308)
at org.elasticsearch.index.mapper.object.ObjectMapper$TypeParser.parseObjectOrDocumentTypeProperties(ObjectMapper.java:221)
at org.elasticsearch.index.mapper.object.RootObjectMapper$TypeParser.parse(RootObjectMapper.java:138)
at org.elasticsearch.index.mapper.DocumentMapperParser.parse(DocumentMapperParser.java:119)
at org.elasticsearch.index.mapper.DocumentMapperParser.parse(DocumentMapperParser.java:100)
at org.elasticsearch.index.mapper.MapperService.parse(MapperService.java:435)
at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.applyRequest(MetaDataMappingService.java:257)
at org.elasticsearch.cluster.metadata.MetaDataMappingService$PutMappingExecutor.execute(MetaDataMappingService.java:230) at org.elasticsearch.cluster.service.InternalClusterService.runTasksForExecutor(InternalClusterService.java:458)
at org.elasticsearch.cluster.service.InternalClusterService$UpdateTask.run(InternalClusterService.java:762)
我的日志存储配置
input {
beats {
port => 11153
}
}
filter
{
if [type] == "person_get" {
##Parsing JSON input to JSON Filter..
json {
source => "message"
}
mutate{
rename => { "@person.name" => "@person-name" }
remove_field => [ "@person.name"]
}
fingerprint {
source => ["ResponseTimestamp"]
target => "fingerprint"
key => "78787878"
method => "SHA1"
concatenate_sources => true
}
}
}
output{
if [type] == "person_get" {
elasticsearch {
index => "logstash-person_v1"
hosts => ["xxx.xxx.xx:9200"]
document_id => "%{fingerprint}" # !!! prevent duplication
}
stdout {
codec => rubydebug
}
} }
如果运行它而不删除变种中的\u字段,会怎么样?我的意思是你的变异重命名应该可以正常工作?当你在你的变种中进行重命名时,你有没有收到任何错误?我没有收到任何错误,但是字段名没有被重命名。我不知道发生了什么,Logstash2.3也有同样的问题。4@ShawnSim我的问题解决了。如果你发送你的配置和输入,我会帮你。