递归在 logstash 中的 kv 过滤器中不起作用

Question

我想知道kv filter中递归函数的使用。我正在使用一个 csv 文件。我使用 logstash 将文件上传到 ES。阅读此指南后 link https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html#plugins-filters-kv-recursive

我开始知道它复制了 key/values 对并将其存储在一个单独的密钥中。但我无法获得有关过滤器的其他信息或示例。我在 logstash 配置文件中添加了一个递归行。没有变化。它是用值（键值对）复制字段还是这个函数在做什么？？？

这是我通过 logstash 传递的示例 csv 文件数据：

"host" => "smackcoders",
                  "Driveline" => "Four-wheel drive",
                       "Make" => "Jeep",
                      "Width" => "79",
                     "Torque" => "260",
                       "Year" => "2012",
                 "Horsepower" => "285",
                   "City_mpg" => "17",
                     "Height" => "34",
             "Classification" => "Manual,Transmission",
                 "Model_Year" => "2012 Jeep Wrangler",
    "Number_of_Forward_Gears" => "6",
                     "Length" => "41",
                "Highway_mpg" => "21",
                   "@version" => "1",
                    "message" => "17,\"Manual,Transmission\",Four-wheel drive,Jeep 3.6L 6 Cylinder 280 hp 260 lb-ft,Gasoline,34,21,285,False,2012 Jeep Wrangler Arctic,41,Jeep,2012 Jeep Wrangler,6,260,6 Speed Manual,79,2012",
                  "Fuel_Type" => "Gasoline",
                "Engine_Type" => "Jeep 3.6L 6 Cylinder 280 hp 260 lb-ft",
                       "path" => "/home/paulsteven/log_cars/cars.csv",
                     "Hybrid" => "False",
                         "ID" => "2012 Jeep Wrangler Arctic",
                 "@timestamp" => 2019-04-20T07:58:26.552Z,
               "Transmission" => "6 Speed Manual"
}

这是配置文件：

input {
   file {
      path => "/home/paulsteven/log_cars/cars.csv"
      start_position => "beginning"
      sincedb_path => "/dev/null"
   }
}
filter {
    csv {
        separator => ","
        columns => ["City_mpg","Classification","Driveline","Engine_Type","Fuel_Type","Height","Highway_mpg","Horsepower","Hybrid","ID","Length","Make","Model_Year","Number_of_Forward_Gears","Torque","Transmission","Width","Year"]
    }
    kv {
        recursive => "true"
    }
}
output {
  elasticsearch {
    hosts => "localhost:9200"
    index => "kvfilter1"
    document_type => "details"
  }
  stdout{}
}

Answer 1

在 kv 过滤器中找到了一些递归的例子：

input { generator { count => 1 message => 'foo=1,bar="foor=10,barr=11"' } }

filter {
    kv { field_split => "," value_split => "=" recursive => false }
}

会产生

   "foo" => "1",
   "bar" => "foor=10,barr=11",

而

input { generator { count => 1 message => 'foo=1,bar="foor=10,barr=11"' } }

filter {
    kv { field_split => "," value_split => "=" recursive => true }
}

会产生

       "foo" => "1",
       "bar" => {
    "foor" => "10",
    "barr" => "11"
},

递归在 logstash 中的 kv 过滤器中不起作用

Recursive not working in kv filter in logstash

elasticsearch

logstash

logstash-grok

logstash-configuration

elastic-stack