如何在 logstash 输入生成部分中传递硬编码数据

Question

如何从生成的输入传递硬编码数据，当我通过输入部分传递此输入时，logstash 已成功执行但未在控制台中生成任何过滤输出。有没有办法在输入生成器部分传递 json？

注意-我从一些日志文件中获取了这个输入数据...

input {
       generator { 
            lines => [\"clientContextId\":\"INTERNAL-b8d19563-94a1-442d-9a09-dde36743fb7d\",\"description\":\"A N1QL EXPLAIN statement was executed\",\"id\":28673,\"isAdHoc\":true,\"metrics\":{\"elapsedTime\":\"11.921ms\",\"executionTime\":\"11.764ms\",\"resultCount\":1,\"resultSize\":649},\"name\":\"EXPLAIN statement\",\"node\":\"127.0.0.1:8091\",\"real_userid\":{\"domain\":\"builtin\",\"user\":\"Administrator\"},\"remote\":{\"ip\":\"127.0.0.1\",\"port\":44695},\"requestId\":\"958a7e12-d5a6-4d7b-bd40-ac9bb60cf4a3\",\"statement\":\"explain INSERT INTO `Guardium` (KEY, VALUE) \nVALUES ( \\"id::5554\n\\", { \\"Emp Name\\": \\"Test4\\", \\"Emp Company\\" : \\"GS Lab\\", \\"Emp Country\\" : \\"India\\"} )\nRETURNING *;\",\"status\":\"errors\",\"timestamp\":\"2021-01-07T09:37:00.486Z\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 (Couchbase Query Workbench (6.6.1-9213-enterprise))\"] 
                }
 }
filter{
// filter logic 
}
output{
  stdout { codec => rubydebug }
}

Answer 1

是的，您可以在生成器输入中包含 JSON。例如

input { generator { count => 1 lines => [ '{ "id": "43fb7d", "description": "..." }' ] } }
filter { json { source => "message" } }

将导致

"description" => "...",
         "id" => "43fb7d",

如何在 logstash 输入生成部分中传递硬编码数据

How to pass hardcoded data in logstash input generated section

logstash

logstash-grok