使用根对象的Logstash合并字段

Question

我有logstash输入,看起来像这样

{
    "@timestamp": "2016-12-20T18:55:11.699Z",
    "id": 1234,
    "detail": {
        "foo": 1
        "bar": "two"
    }
}

我想将"detail"的内容与根对象合并,以便最终事件如下所示:

{
    "@timestamp": "2016-12-20T18:55:11.699Z",
    "id": 1234,
    "foo": 1
    "bar": "two"
}

有没有办法在不编写自己的过滤器插件的情况下完成此操作？

Answer 1

您可以使用ruby过滤器执行此操作.

filter { ruby { code => " event['detail'].each {|k, v| event[k] = v } event.remove('detail') " } }