如何在Logstash中为电子邮件正文漂亮地打印JSON? [英] How do I pretty-print JSON for an email body in logstash?

问题描述

我有一个Logstash配置，该配置已用于转发电子邮件中的日志消息.它使用json和json_encode来解析和重新编码JSON日志消息.

I have a Logstash configuration that I've been using to forward log messages in emails. It uses json and json_encode to parse and re-encode JSON log messages.

json_encode曾经漂亮地打印了JSON，使JSON看起来非常漂亮.不幸的是，随着最近Logstash的升级，它不再具有漂亮的打印效果.

json_encode used to pretty-print the JSON, which made for very nice looking emails. Unfortunately, with recent Logstash upgrades, it no longer pretty prints.

有什么办法可以将事件的漂亮形式放入可用于电子邮件正文的字段中?我可以使用JSON，Ruby调试或大多数其他人类可读格式.

Is there any way I can get a pretty form of the event into a field that I can use for the email bodies? I'm fine with JSON, Ruby debug, or most other human readable formats.

filter {
    if [type] == "bunyan" {
        # Save a copy of the message, in case we need to pretty-print later
        mutate {
            add_field => { "@orig_message" => "%{message}" }
        }

        json {
            source => "message"
            add_tag => "json"
        }
    }

    // other filters that might add an "email" tag

    if "email" in [tags] {
        # pretty-print JSON for the email
        if "json" in [tags] {
            # re-parse the message into a field we can encode
            json {
                source => "@orig_message"
                target => "body"
            }

            # encode the message, but pretty this time
            json_encode {
                source => "body"
                target => "body"
            }
        }

        # escape the body for HTML output
        mutate {
            add_field => { htmlbody => "%{body}" }
        }
        mutate {
            gsub => [
                'htmlbody', '&', '&',
                'htmlbody', '<', '&lt;'
            ]
        }
    }
}

output {
    if "email" in [tags] and "throttled" not in [tags] {
        email {
            options => {
                # config stuff...
            }
            body => "%{body}"
            htmlbody => "
<table>
  <tr><td>host:</td><td>%{host}</td></tr>
  <tr><td>when:</td><td>%{@timestamp}</td></tr>
</table>
<pre>%{htmlbody}</pre>
"
        }
    }
}

推荐答案

正如roxiblue所说，此问题是由logstash的旧解析器作为解决方法，直到再次添加漂亮打印支持.方法如下:

As said by approxiblue, this issue is caused by logstash's new JSON parser (JrJackson). You can use the old parser as a workaround until pretty-print support is added again. Here is how:

您需要更改插件的ruby文件的两行.路径应类似于:

You need to change two lines of the plugin's ruby file. Path should be something like:

LS_HOME/vendor/bundle/jruby/1.9/gems/logstash-filter-json_encode-0.1.5/lib/logstash/filters/json_encode.rb

更改行 5

require "logstash/json" 

进入

require "json" 

并更改行 44

event[@target] = LogStash::Json.dump(event[@source])

进入

event[@target] = JSON.pretty_generate(event[@source])

仅此而已.重新启动logstash后，应再次打印漂亮的

That's all. After restarting logstash should pretty-print again.

补充:

如果您不喜欢更改红宝石源，也可以使用红宝石过滤器代替json_encode:

In case you don't like changing your ruby sources you could also use a ruby filter instead of json_encode:

# encode the message, but pretty this time
ruby  {
    init => "require 'json'"
    code => "event['body'] = JSON.pretty_generate(event['body'])"
}

这篇关于如何在Logstash中为电子邮件正文漂亮地打印JSON?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！