Logstash 当我试图为数组传递更深的引用时，Split似乎抛出了一个错误

我有一些简单的代码：

{ "bustime-response": { "vehicle": [ {"vid": "foo"}] }}

当我试图运行我设置的conf文件时，它会崩溃。我认为这与拆分字段的要求有关，但我不确定是怎么回事

split {
  field => "[bustime-response][vehicle]"
}

删除拆分时，系统将记录完整的json对象，但我试图为每个“车辆”创建单独的事件，而每个“车辆”都有一个“vid”作为主键，因为一条路线上可能有多辆车辆

在处理JSON时，我是否遗漏了什么？我正在查看拆分的文档，字段的信息是：

由终止符拆分值的字段。可以是多行消息或数组的ID。嵌套数组的引用方式如下：“[object\u id][array\u id]”

my docker容器中的日志为：

[ERROR] 2020-10-12 19:14:14.450 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"input\", \"filter\", \"output\" at line 12, column 1 (byte 270) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:183:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:44:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357:in `block in converge_state'"]}
[INFO ] 2020-10-12 19:14:14.554 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2020-10-12 19:14:19.590 [LogStash::Runner] runner - Logstash shut down.

[ERROR]2020-10-12 19:14:14.450[Converge PipelineAction:：Create]代理程序-无法执行操作{:action=>LogStash:：PipelineAction:：Create/pipeline\u id:main，：exception=>“LogStash:：ConfigurationError”，：message=>“应为[\\t\\r\\n]，\”，“input\，“filter\”，“output\”，在第12行第1列（字节270），在“，：backtrace=>[“/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in‘compile_-private’”，“org/logstash/execution/AbstractPipelineExt.java:183:in‘initialize’，“org/logstash/execution/JavaBasePipelineExt.java:69:in‘initialize’，/usr/share/logstash/logstash/logstash/core/lib/logstash/java_-pipeline.rb:44:in‘initialize’”/usr/share/logstash/logstash core/lib/logstash/pipeline_action/create.rb:52:in'execute'”/usr/share/logstash/logstash core/lib/logstash/agent.rb:357:in'block in converge_state'）
[INFO]2020-10-12 19:14:14.554[Api Webserver]代理-已成功启动Logstash Api端点{:port=>9600}
[信息]2020-10-12 19:14:19.590[日志存储：：转轮]转轮-日志存储关闭。

拆分，如mutate，需要存在于“filter”块中。它们不是独立的选项