是否可以使用 mutate 将 json 日志中的嵌套 json 字段值拆分为 logstash 过滤中的其他子字段？答案

【问题标题】：is it possible to split a nested json field value in json log into further sub fields in logstash filtering using mutate?是否可以使用 mutate 将 json 日志中的嵌套 json 字段值拆分为 logstash 过滤中的其他子字段？
【发布时间】：2022-01-16 22:39:45
【问题描述】：

我有一个这样的 json 日志正在流式传输到 ELK

{
  "event": "Events Report",
  "level": "info",
  "logger": "XXXXX",
  "method": "YYYYY",
  "report_duration": {
    "duration": "5 days, 12:43:16",
    "end": "2021-12-13 03:43:16",
    "start": "2021-12-07 15:00:00"
  },
  "request_type": "GET",
  "rid": "xyz-123-yzfs",
  "field_id": "arefer-e3-adfe93439",
  "timestamp": "12/13/2021 03:43:53 AM",
  "user": "8f444233ed4-91b8-4839-a57d-ande2534"
}

我想进一步拆分持续时间值，即“5 天，12:43:16”，例如“天”：“5”

我尝试使用下面的 logstash 过滤器，但仍然无法正常工作

filter {
        if "report_duration" in [reports]{
           mutate {
            split => { "duration" => " " }
            add_field => { "days" => "%{[duration][0]}" }
            convert => {
             "days" => "integer"
            }
          }
       }
}

【问题讨论】：

标签： json logstash logstash-grok

【解决方案1】：

我想我有适合你想要的配置：

    # Since I wasn't sure of what you wanted, I changed the conditional here to check if the duration nested field is present
    if [report_duration][duration]{
       mutate {
        # Since duration is nested under report_duration, it has to be accessed this way:
        split => { "[report_duration][duration]" => " " }
        # The split option replace the text field with an array, so it's still nested
        add_field => { "days" => "%{[report_duration][duration][0]}" }
      }
      # the convert option is executed before the split option, so it has to be moved in its own plugin call
      mutate {
        convert => {
         "days" => "integer"
        }
      }
   }

一些参考：accessing nested fields，mutate filter process order

【讨论】：