如何使用 ruby 代码在 logstsh 中动态解析 json 对象

Question

我有这个作为输入，我需要解析所有的键和值并放入一个单独的事件中，你能帮我如何实现吗，实际上当我使用以下 ruby 代码时，我只是一个键和值。

"entities": {
"PROCESS_GROUP_INSTANCE-EA653E6874E21338": "WebSphere AS nzapwa145Cell (nzapwa146 / ePIMS_pwa146)",
"PROCESS_GROUP_INSTANCE-64A2967FB7FC0C5B": "WebSphere AS ndmProd (nzapwa127 / ePIMS_Report_pwa127)",
"PROCESS_GROUP_INSTANCE-4738C9392BDBC296": "EPS Store - 900008014",
"PROCESS_GROUP_INSTANCE-BA196B9B53FF6323": "EPS Store - 900008040",
"PROCESS_GROUP_INSTANCE-D5D2DAB06C8FDAAF": "ws-server.jar prod-sj-userprofile-adapter-service- - -*",
"PROCESS_GROUP_INSTANCE-3EABAD79933CE911": "/apps/conf/httpd-p2_cdis.conf - KPATHS",
}

法典：

ruby {
code => '
event.get("[result][entities]").each { |key, value|
event.set("hostId", key)
event.set("serverName", value)
}
'
}

上述代码的输出：

{"serverName":"/apps/conf/httpd-p2_cdis.conf - KPATHS)","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-3EABAD79933CE911"}

但是期望的输出将是这样的：

{"serverName":"WebSphere AS nzapwa145Cell (nzapwa146 / ePIMS_pwa146)","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-EA653E6874E21338"}
{"serverName":"WebSphere AS ndmProd (nzapwa127 / ePIMS_Report_pwa127)","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-64A2967FB7FC0C5B"}
{"serverName":"EPS Store - 900008014","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-4738C9392BDBC296"}
{"serverName":"ws-server.jar prod-sj-userprofile-adapter-service- - -*","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-BA196B9B53FF6323"}
{"serverName":"/apps/conf/httpd-p2_cdis.conf - KPATHS","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-D5D2DAB06C8FDAAF"}
{"serverName":"/apps/conf/httpd-p2_cdis.conf - KPATHS)","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-3EABAD79933CE911"}

你能帮我找到解决方案吗，我遇到了 ruby 代码的问题。

Answer 1

我不是 Logstash 专家，但我认为您的 Ruby 过滤器在迭代所有给定的键值对时会多次覆盖(设置(hostId和serverName的值。这样就剩下在上次迭代中设置的值。毕竟，只有一个事件，因此您的密钥必须是唯一的。要解决此问题，您需要通过将事件的键字段嵌套在树结构中或创建唯一的键字符串来扩展该字段。

在这里，hostId是唯一的键：

ruby {
code => '
event.get("[result][entities]").each do |key, value|
event.set(key, value)
end
'
}

这里添加了一个额外的索引以确保唯一的键：

ruby {
code => '
idx = 0
event.get("[result][entities]").each do |key, value|
event.set("[#{idx}][hostId]", key)
event.set("[#{idx}][serverName]", value)
idx += 1
end
'
}

我希望你觉得有帮助。