Logstash检查&解析子字段的存在性

Question

在Logstash中,我有一个JSON有效负载,我已经解码过如下:

filter 
{ 
   json 
   { 
     source => "payload" 
     target => "payloadData" 
   }
}

现在我想检查payloadData._extraData是否存在,然后再反序列化.

我试过这个方法,从这个相关问题给出的例子开始:

filter 
{ 
   json 
   { 
     source => "payload" 
     target => "payloadData" 
   }
   if [payloadData._extraData] =~ /.+/ 
   { 
       sourcce => "payloadData._extraData"  
       target => "payloadData.extraData" 
   } 
}

但它没有做任何事情(没有崩溃,没有错误信息,只是没有做任何事情)

Answer 1

正确的语法是:

if [payloadData][_extraData] =~ /.+/   { }

输入示例:

{"foo":"bar","spam":"eggs","abc":"xyz","one":"two","three":"four","five":"six","seven":{"eight":"nine"}}

配置:

filter {
    json { source => message }
    if [seven][eight] =~ /.+/ {
        # do something
    }
}

除此之外,if语句中的代码不执行任何操作.您需要指定应执行的过滤器.例如:

if [payloadData][_extraData] =~ /.+/  { 
   json {
       source => "payloadData[_extraData]"  
       target => "payloadData[extraData]" 
   }
} 

你想在if语句中反序列化什么？第一个json过滤器应该识别嵌套对象.