如何解析logstash中的字段值？

Question

我有 logstash，我在其中从 HTTP API 获取数据，但是有一个字段我需要从中解析值

 "ServiceProvider": "T:ISP | CIR:450Mbps BR:1Gbps | VD:Beq | CID:124"

至此

"ServiceProvider": "T:ISP"
"CIR": "450Mbps"
"BR": "1Gbps"
"VD": "Beq"
"CID": "124"

我的 Logstash 配置文件是：

input{
  http_poller {
    urls => {
      "ISP" => {
         method => get
         url => "http://xyz:8080/api"
         headers => {
           Accept => "application/json"
         }
      }
    }
    request_timeout => 60    
    tags => "hourly"
    schedule => { cron => "30 * * * *"}
    codec => "json"
    metadata_target => "meta"
  }
}
filter {
  mutate {
     remove_field => [ "[meta][request][auth][user]", "[meta][request][auth][pass]","[meta][request][headers][Accept]" ]
  } 
}
output {
  elasticsearch {
    hosts => ["http://xyz:9100"]
    index => "xyz"
  }
}

提前致谢！！

Answer 1

我会像这样利用 dissect filter and kv filter：

filter {
    dissect {
      mapping => {
        "message" => "%{ServiceProvider} | %{[@metadata][kv]}"
      }
    }
    kv {
      source => "[@metadata][kv]"
      field_split => "| "
      value_split => ":"
    }
    mutate {
      remove_field => [ "[meta][request][auth][user]", "[meta][request][auth][pass]","[meta][request][headers][Accept]" ]
    } 
}

如何解析logstash中的字段值？

How to parse the field value in logstash?

elasticsearch

logstash

logstash-grok