自定义输入映射 JSON : 找不到任何与 JSON 路径匹配的传入事件

Question

我有一个带有自定义输入映射的事件接收器，因为我的事件格式有点不同。它没有元或相关属性。例子是：

{ "ts":"2016-05-08T08:59:47.363764Z",
  "uid":"CLuCgz3HHzG7LpLwH9",
  "id.orig_h":"172.30.26.119",
  "id.orig_p":51976,
  "id.resp_h":"172.30.26.160",
  "id.resp_p":22,
  "version":2,
  "client":"SSH-2.0-OpenSSH_5.0",
  "server":"SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.6",
  "cipher_alg":"arcfour256",
  "mac_alg":"hmac-md5",
  "compression_alg":"none",
  "kex_alg":"diffie-hellman-group-exchange-sha1",
  "host_key_alg":"ssh-rsa",
  "host_key":"8d:df:71:ac:29:1f:67:6f:f3:dd:c3:e5:2e:5f:3e:b4"}

没有换行符，我添加了它以使其可读。因此，我创建了一个带有自定义输入映射的事件接收器：

<?xml version="1.0" encoding="UTF-8"?>
<eventReceiver name="sshlogreceiver" statistics="disable"
trace="disable" xmlns="http://wso2.org/carbon/eventreceiver">
<from eventAdapterType="http">
    <property name="transports">all</property>
</from>
<mapping customMapping="enable" type="json">
    <property>
        <from jsonPath="$.ts"/>
        <to name="ts" type="string"/>
    </property>
    <property>
        <from jsonPath="$.uid"/>
        <to name="uid" type="string"/>
    </property>
    <property>
        <from jsonPath="$.id.orig_h"/>
        <to name="id_orig_h" type="string"/>
    </property>
    <property>
        <from jsonPath="$.id.orig_p"/>
        <to name="id_orig_p" type="int"/>
    </property>
    <property>
        <from jsonPath="$.id.resp_h"/>
        <to name="id_resp_h" type="string"/>
    </property>
    <property>
        <from jsonPath="$.id.resp_p"/>
        <to name="id_resp_p" type="int"/>
    </property>
    <property>
        <from jsonPath="$.version"/>
        <to name="version" type="int"/>
    </property>
    <property>
        <from jsonPath="$.client"/>
        <to name="client" type="string"/>
    </property>
    <property>
        <from jsonPath="$.server"/>
        <to name="server" type="string"/>
    </property>
    <property>
        <from jsonPath="$.cipher_alg"/>
        <to name="cipher_alg" type="string"/>
    </property>
    <property>
        <from jsonPath="$.mac_alg"/>
        <to name="mac_alg" type="string"/>
    </property>
    <property>
        <from jsonPath="$.compression_alg"/>
        <to name="compression_alg" type="string"/>
    </property>
    <property>
        <from jsonPath="$.kex_alg"/>
        <to name="kex_alg" type="string"/>
    </property>
    <property>
        <from jsonPath="$.host_key_alg"/>
        <to name="host_key_alg" type="string"/>
    </property>
    <property>
        <from jsonPath="$.host_key"/>
        <to name="host_key" type="string"/>
    </property>
</mapping>
<to streamName="SSHInStream" version="1.0.0"/>
</eventReceiver>

输入流的样本事件为：

{
"event": {
    "payloadData": {
        "ts": "data5",
        "uid": "data5",
        "id_orig_h": "data1",
        "id_orig_p": 70,
        "id_resp_h": "data3",
        "id_resp_p": 4,
        "version": 50,
        "client": "data1",
        "server": "data2",
        "cipher_alg": "data5",
        "mac_alg": "data3",
        "compression_alg": "data3",
        "kex_alg": "data4",
        "host_key_alg": "data4",
        "host_key": "data4"
    }
}
}

我的事件中没有 event 和 payload 标签，因为它是一个简单的日志文件。当我尝试发送事件时，我在控制台上收到一条错误消息：

错误

{org.wso2.carbon.event.receiver.core.internal.type.json.JSONInputMapper} -  Could not find any matches for the incoming event with JSONPath : com.jayway.jsonpath.JsonPath@543abe49 ,hence dropping the event

我是否做错了自定义输入映射或者我还需要做什么？

Answer 1

该错误的原因是我的事件参数中存在点 (.)。一旦我用另一个字符替换它们，在我的例子中我选择了下划线，它工作正常。

自定义输入映射 JSON : 找不到任何与 JSON 路径匹配的传入事件

Custom Input Mappings JSON : Could not find any matches for the incoming event with JSONPath

mapping

json

event-receiver

wso2cep