Question

The bounty expires in 3 hours. Answers to this question are eligible for a +100 reputation bounty. Nishant Dixit wants to draw more attention to this question.

我的目标是,读到3号地基底和上载的茨夫档案中的数据,但是,在Csv文档中,arrow(=>)正用 j子数据输入(以下)上校。

记录仪表

input {
  kinesis {
    application_name => "logstash"
    kinesis_stream_name => "events"
    type => "kinesis"
    region => "us-east-1"
    profile => "default"
    metrics => "cloudwatch"
    codec => "json"
  }
}

filter {
    grok {
      match => { "[data][ti]" => "%{YEAR:event_year}-%{MONTHNUM2:event_month}-%{MONTHDAY:event_day}" }
   }
}

output {
  s3 {
    bucket => "test-logstash"
    region => "us-east-1"
    prefix => "%{event_year}/%{event_month}/%{event_day}/%{[data][brandid]}/%{[data][event_name]}"
    encoding => "none"
    codec => csv {
        separator => "␁"
    }
    size_file => 200000000
    time_file => 60
  }
}

Answer 1

在将Hass写到CSV档案时,使用<条码>将其改为JSON>_json ,或使用<条码>至_json的JSON string。

Answer 2

您可在Logstash使用变体过滤器,将“箭(=>)”改为“上校(:)”。

input {
  kinesis {
    application_name => "logstash"
    kinesis_stream_name => "events"
    type => "kinesis"
    region => "us-east-1"
    profile => "default"
    metrics => "cloudwatch"
    codec => "json"
  }
}

filter {
  # Use the mutate filter to replace "arrow (=>)" with "colon (:)"
  mutate {
    gsub => [
      "message", "=>", ":"
    ]
  }

  grok {
    match => { "[data][ti]" => "%{YEAR:event_year}-%{MONTHNUM2:event_month}-%{MONTHDAY:event_day}" }
  }
}

output {
  s3 {
    bucket => "test-logstash"
    region => "us-east-1"
    prefix => "%{event_year}/%{event_month}/%{event_day}/%{[data][brandid]}/%{[data][event_name]}"
    encoding => "none"
    codec => csv {
      separator => "␁"
    }
    size_file => 200000000
    time_file => 60
  }
}

在过滤科,变压过滤器被用于进行全球替代(gsub)以替换“箭(=>)”。这应确保按照预期正确处理你的初专干事数据。

如果你的初专干事数据位于不同的领域,则确保调和相互过滤器中的外地名称(名称)。

友情链接