我想使用 logstash 和 Kibana 以網格格式顯示 XML 資料。使用下面的 conf 檔案，我可以將資料顯示到網格中，但不能拆分行資料。例子：
輸出
logstash.conf 檔案：
input {
file {
path => "C:/ELK Stack/logstash-8.2.0-windows-x86_64/logstash-8.2.0/Test.xml"
start_position => "beginning"
sincedb_path => "NUL"
codec => multiline {
pattern => "^<?stations.*>"
negate => "true"
what => "previous"
auto_flush_interval => 1
max_lines => 3000
}}}
filter
{
xml
{
source => "message"
target => "parsed"
store_xml => "false"
xpath => [
"/stations/station/id/text()", "station_id",
"/stations/station/name/text()", "station_name"
]
}
mutate {
remove_field => [ "message"]
}
}
output {
elasticsearch {
action => "index"
hosts => "localhost:9200"
index => "logstash_index123xml"
workers => 1
}
stdout {
codec => rubydebug
}
}
uj5u.com熱心網友回復：
xpath 將始終回傳陣列，以關聯您需要使用 ruby?? 過濾器的兩個陣列的成員。要獲取多個事件，您可以使用拆分過濾器拆分您在 ruby?? 過濾器中構建的陣列。如果你從
<stations>
<station>
<id>1</id>
<name>a</name>
<id>2</id>
<name>b</name>
</station>
</stations>
那么如果你使用
xml {
source => "message"
store_xml => "false"
xpath => {
"/stations/station/id/text()" => "[@metadata][station_id]"
"/stations/station/name/text()" => "[@metadata][station_name]"
}
remove_field => [ "message" ]
}
ruby {
code => '
ids = event.get("[@metadata][station_id]")
names = event.get("[@metadata][station_name]")
if ids.is_a? Array and names.is_a? Array y and ids.length == names.length
a = []
ids.each_index { |x|
a << { "station_name" => names[x], "station_id" => ids[x] }
}
event.set("[@metadata][theData]", a)
end
'
}
if [@metadata][theData] {
split {
field => "[@metadata][theData]"
add_field => {
"station_name" => "%{[@metadata][theData][station_name]}"
"station_id" => "%{[@metadata][theData][station_id]}"
}
}
}
你會得到兩個事件
{
"station_name" => "a",
"station_id" => "1",
...
}
{
"station_name" => "b",
"station_id" => "2",
...
}
轉載請註明出處，本文鏈接：https://www.uj5u.com/net/479696.html
下一篇：為什么這個查詢有0次點擊？