Logstash output to file, from JSON field not exist / field is empty, about output format

Elastic Stack Logstash
1

I'm new in using logstash (6.3.2) to parse log data, I want to parse datas in json fmt from logs file to txt files. The steps of input and filter are ok, but there's some problem with output, below is the output section from my code snippet:

output {
    if [channel] == "brsdk" {
        file {
            codec => 
                line {
                    format => "%{bussiness}^^%{channel}^^%{[databody][name]}^^%{[databody][certNo]}^^%{[databody][eventType]}^^%{[databody][customerId]}^^%{[databody][mobile]}^^%{[databody][dataFrom]}"
                }
            path => "/data/log/logstash/%{+YYYYMM}/brsdk.%{+YYYYMMdd}.txt"
        }
    }
}

As you see, I parse data to text with JSON filed name mapping, but there's little problem, such as: if in JSON:

{"databody":{"certNo":"0222302X","customerId":663626902,"dataFrom":"baiqishi","eventType":"","name":"Lee"},"channel":"bqssdk","bussiness":"query"}

under the databody , the eventType field is empty, the mobile field is not exist, so in the output text looks like [databody][mobile] . my problems are:

  1. If the field value is empty ( eventType ), how to export to text in form as two single quots: '' ;

  2. If the field not exist ( mobile ), how to export to text in form as two single quots: '' ;

I don't know the output codec grammar clearly, and I can't find out some document from offical docs, so how to write in

file {
   codec => 
       line {}
}

Thanks

2

Hi Richard,

Have you considered checking if the field exists in the filter section and then taking appropriate action on it?

So, you can add a value to the field if it does not exist.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.