Thank you so much!
I remomed mutate
lines and added event.set. It looks like
grok {
match => { "logdata" => ["(spx.responce=%{GREEDYDATA:spx_responce}(\n|;))"]}
}
ruby {
# json handler
init => "require 'json'"
code => "
i_json = event.get('spx_responce')
json = JSON.parse(i_json)
result = json.map do |key, value|
if value.is_a?(Array)
value.map { |v| {v.first.last => v['value']} }
else
{ key => value }
end
end
o_json_k = result.flatten.flat_map(&:to_a).to_h.keys
o_json_v = result.flatten.flat_map(&:to_a).to_h.values
event.set("tags.key", o_json_k)
event.set("tags.value", o_json_v)
"
}
prune {
whitelist_names => [ "^hostname$","^domain$","^created$","^ms_duration$","^setuptime$","^call_id$","^code$","^reason$","^ip_src$", "^ip_dst$", "^ip_sdp$", "^sip_from$","^sip_to$","^isup_4xx_fs_cause$","^isup_bye_mss_cause$","^sip_bye_fs_reason$","^spx_req$","^tags.key$","^tags.value$" ]
}
But now I get some mistake when I logstah is starting
[2020-12-11T20:13:40,183][INFO ][logstash.runner ] Logstash shut down.
[2020-12-11T20:13:40,198][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2020-12-11T20:14:00,686][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.10.0", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc OpenJDK 64-Bit Server VM 11.0.8+10 on 11.0.8+10 +indy +jit [linux-x86_64]"}
[2020-12-11T20:14:03,469][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"{\", \"}\" at line 80, column 24 (byte 2341) after filter{\n grok {\n match => { \"message\" => [\"%{SYSLOGTIMESTAMP:date}%{SPACE}%{HOSTNAME:hostname}%{SPACE}/usr/sbin/opensips\\[%{POSINT}\\]: ACC: call %{WORD:call_status}: %{GREEDYDATA:logdata}\"]}\n }\n if [call_status] !~ /.+/ {\n drop {}\n }\n grok {\n match=>{ \"logdata\" => [\"(created=%{NONNEGINT:created})\"]}\n }\n grok {\n match=>{ \"logdata\" => [\"(ms_duration=%{NONNEGINT:ms_duration})\"]}\n }\n grok {\n match=>{ \"logdata\" => [\"(setuptime=%{NONNEGINT:setuptime})\"]}\n }\n grok {\n match=>{ \"logdata\" => [\"(call_id=%{GREEDYDATA:call_id};code)\"]}\n }\n grok {\n match=>{ \"logdata\" => [\"(code=%{NONNEGINT:code})\"]}\n }\n grok {\n match=>{ \"logdata\" => [\"(reason=%{DATA:reason};ip)\"]}\n }\n grok {\n match => { \"logdata\" => [\"(ip.src=%{IP:ip_src})\"]}\n }\n grok {\n match => { \"logdata\" => [\"(ip.dst=%{IP:ip_dst})\"]}\n }\n grok {\n match => { \"logdata\" => [\"(ip.sdp=%{IP:ip_sdp})\"]}\n }\n grok {\n match => { \"logdata\" => [\"(sip.from=(\\+|.*)%{NONNEGINT:sip_from};)\"]}\n }\n grok {\n match => { \"logdata\" => [\"(sip.to=%{NONNEGINT:sip_to};)\"]}\n }\n grok {\n match => { \"logdata\" => [\"(isup.4xx_fs.cause=%{NONNEGINT:isup_4xx_fs_cause})\"]}\n }\n grok {\n match => { \"logdata\" => [\"(isup.bye_mss.cause=%{NONNEGINT:isup_bye_mss_cause};)\"]}\n }\n grok {\n match => { \"logdata\" => [\"(sip.bye_fs.reason=%{DATA:sip_bye_fs_reason};spx)\"]}\n }\n grok {\n match => { \"logdata\" => [\"(spx.req=\\{%{DATA:spx_req}\\})\"]}\n }\n grok {\n match => { \"logdata\" => [\"(spx.responce=%{GREEDYDATA:spx_responce}(\\n|;))\"]}\n }\n \n ruby {\n # json handler\n init => \"require 'json'\"\n \n code => \"\n i_json = event.get('spx_responce') \n json = JSON.parse(i_json)\n result = json.map do |key, value|\n if value.is_a?(Array)\n value.map { |v| {v.first.last => v['value']} }\n else\n { key => value }\n end\n end \n o_json_k = result.flatten.flat_map(&:to_a).to_h.keys\n o_json_v = result.flatten.flat_map(&:to_a).to_h.values\n event.set(\"", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:184:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:365:in `block in converge_state'"]}
[2020-12-11T20:14:03,819][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2020-12-11T20:14:08,746][INFO ][logstash.runner ] Logstash shut down.