聚合多个递归logstash [英] aggregate multiple recursive logstash

问题描述

我正在将logstash与输入jdbc一起使用，并希望通过聚合将一个对象嵌入另一个对象。
如何使用添加递归？

I am using logstash with input jdbc, and would like to embed one object inside another with aggregate. How can I use add recursive?

是否在另一个对象内添加对象？

Ie add an object inside another object?

这是一个示例：

{
  "_index": "my-index",
  "_type": "test",
  "_id": "1",
  "_version": 1,
  "_score": 1,
  "_source": {
    "id": "1",
    "properties": {
      "nested_1": [
        {
          "A": 0,
          "B": "true",
          "C": "PEREZ, MATIAS  ROGELIO Y/O",
          "Nested_2": [
            {
              "Z1": "true",
              "Z2": "99999"
            }
        },
        {
          "A": 0,
          "B": "true",
          "C": "SALVADOR MATIAS ROMERO",
          "Nested_2": [
            {
              "Z1": "true",
              "Z2": "99999"
            }
        }
      ]
    }
  }
}

我正在使用类似的方法，但是它不起作用

I'm using something like that but it doesn't work

aggregate {
  task_id => "%{id}"
  code => "
      map['id'] = event.get('id')
      
      map['nested_1_list'] ||= []
      map['nested_1'] ||= []
      if (event.get('id') != nil)
        if !( map['nested_1_list'].include?event.get('id') ) 
          map['nested_1_list'] << event.get('id')
 
          map['nested_1'] << {
            'A' => event.get('a'),                             
            'B' => event.get('b'),
            'C' => event.get('c'),
            
             map['nested_2_list'] ||= []
              map['nested_2'] ||= []
              if (event.get('id_2') != nil)
                if !( map['nested_2_list'].include?event.get('id_2') ) 
                  map['nested_2_list'] << event.get('id_2')
         
                  map['nested_2'] << {
                    'Z1' => event.get('z1'), 
                    'Z2' => event.get('z2')
                  }
                end
              end
          }
        end
      end
       
      event.cancel()
  "
  push_previous_map_as_event => true
  timeout => 3

} 

有什么想法可以实现吗？... ................
...................

Any idea how to implement this?........................ ..........

推荐答案

最后我要做的是从输入（即从logstash的输入语句的视图（vw）使用的存储过程）生成JSON。

Finally what I did was, generate the JSON from the input, that is, from a stored procedure that is consumed from a view (vw) from the input statement of logstash.

一旦消耗掉，我就将其作为json处理，并且我已经将该json用作另一个变量。

Once consumed, I process it as json and I already have that json to work as one more variable.

# Convierto el string a json real (quita comillas y barras invertidas)
        ruby {
            code => "
                require 'json'
                json_value = JSON.parse(event.get('field_db').to_s)
                event.set('field_convert_to_json',json_value)
            "
        }

这篇关于聚合多个递归logstash的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！