I find mutate filter can convert a field type, but how to convert a nested one?
I've tried:
mutate {
convert => {"logdetail.params" => "string"}
}
And
mutate {
convert => {"[logdetail][params]" => "string"}
}
But failed.
The latter should work. What does the message look like? Please use a stdout { codec => rubydebug } output so we get the raw data.
{
"@timestamp" => 2016-04-01T06:17:16.494Z,
"host" => "shifudao",
"type" => "rtds",
"loglevel" => "WARN",
"classname" => "hawkeyes.rtds.gate.protocol.frametype.SamplerReportData",
"logdetail" => {
"message" => "设备00004650数据上报帧里的sid为空，可能未发过心跳，丢弃！",
"action" => "fireEquipmentDataArrived(String writeHandlerID, String sid, Vertx vertx, List result)",
"sid" => nil,
"params" => {
"writeHandlerID" => "b6728301-653e-488c-91b8-fc2aa52c1312",
"sid" => nil,
"result" => [
[0] {
"eId" => "00004650",
"date" => 963328184494,
"items" => [
[0] [
[0] 1,
[1] [
[0] 74,
[1] 0,
[2] 0,
[3] 0
]
],
[1] [
[0] 2,
[1] [
[0] -119,
[1] 0,
[2] 0,
[3] 0
]
],
[2] [
[0] 3,
[1] [
[0] 12,
[1] 0,
[2] 0,
[3] 0
]
],
[3] [
[0] 4,
[1] [
[0] 12,
[1] 0,
[2] 0,
[3] 0
]
],
[4] [
[0] 5,
[1] [
[0] 110,
[1] 5,
[2] 0,
[3] 0
]
],
[5] [
[0] 6,
[1] [
[0] 61,
[1] 5,
[2] 0,
[3] 0
]
],
[6] [
[0] 7,
[1] [
[0] -18,
[1] 5,
[2] 0,
[3] 0
]
],
[7] [
[0] 8,
[1] [
[0] 3,
[1] 8,
[2] 0,
[3] 0
]
],
[8] [
[0] 9,
[1] [
[0] 0,
[1] 0,
[2] 0,
[3] 0
]
]
]
}
]
}
},
"@version" => "1"
}
logdetail.params is a nested json object, and I want to convert it to string.
Oh. Such objects can't be converted to a string (see below). Perhaps the json_encode filter would be useful?
Oh, I read the official doc carefully, and I find this reason:
If the field is a hash, no action will be taken.
So this field is a hash. But how to I perform a toString() action?
But json_encode convert a string to json. I want to convert a nested json to string. How to?
No, you have a field that happens to be nested that you for some reason want to transform to a string representation. The json_encode filter serializes a field to JSON. JSON is a string.
Great! json_encode works for me now.
And is there any built-in filter alternative ? Maybe ruby could also work, but I'm not good at not ruby. I don't know how to use ruby to implement.
And is there any built-in filter alternative ?
Alternative that does what?
Do the same with json_encode, just like my title. But it's a built-in filter. Maybe the ruby filter could do the same thing, but I'm not good at ruby, is there any examples?
So what you're really asking for is JSON serialization with a core plugin? That should indeed be possible with a ruby filter but I don't have any example at hand, except of course the json_encode source code.
Thanks all the same.