根据logstash中的模式将字符串转换为数组 [英] convert string to array based on pattern in logstash

问题描述

我的原始数据.

{
  message: {
      data: "["1,2","3,4","5,6"]"
  }
}

现在我想将数据字段的值转换为数组. 所以它应该变成:

Now I want to convert value of data field to an array. So it should become:

{
  message: {
      data: ["1,2", "3,4", "5,6"]
  }
}

通过

mutate {
    gsub => ["data", "[\[\]]", ""]
  }

我摆脱了方括号.

此后，我尝试根据逗号进行拆分.但这是行不通的.由于我的数据也包含逗号.

After this, I tried splitting based on commas. But that won't work. Since my data has commas as well.

我尝试编写 dissect块但这没用.

那我应该怎么做呢?

推荐答案

您是否尝试过json过滤器?如果数据字段始终包含有效的json数据，则可以使用json过滤器，如下所示:

Have you tried the json filter? If the data field always contains valid json data, you use the json filter like this:

json {
    source => "data"
    target => "data"
}

使用target => "data"将覆盖数据字段.

这篇关于根据logstash中的模式将字符串转换为数组的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！