I've json file that are formated like this (j'ai des fichiers json formatés comme ci dessous - les données ont été changées)
[
{
"crossConnectVlanRanges": "",
"productAndRelease": "FX-I.2.0",
"role": "",
"supervision": "Supervised",
"name": "CLRX6",
"ipAddress": "10.1.1.196",
"activeSoftwareVersion": "V456.1",
"protectionOlt": ""
},
{
"crossConnectVlanRanges": "",
"productAndRelease": "FX-I.2.0",
"role": "",
"supervision": "Supervised",
"name": "PATT",
"ipAddress": "10.1.1.37",
"activeSoftwareVersion": "V5.1",
"protectionOlt": ""
},
{
"crossConnectVlanRanges": "",
"productAndRelease": "FX-I.3",
"role": "",
"supervision": "Supervised",
"name": "PATT",
"ipAddress": "10.1.1.38",
"activeSoftwareVersion": "V5.1",
"protectionOlt": ""
}
]
To inject json file correctly with logstash in elasticsearch index, I use this configuration :
Pour réussir à les injecter correctement avec logstash, voici la conf. utilisée.
input {
file {
path => "/home/logstash/net/data/file*.json"
mode => "read"
sincedb_path => "/dev/null"
codec => multiline {
pattern=> "^"
what => "next"
}
type => "NET"
exit_after_read => true
}
}
filter {
json {
source => "message"
target => "docs"
remove_field => "message"
}
split {
field => "docs"
}
ruby {
code => '
event.get("docs").each { |k, v|
event.set(k,v)
}
event.remove("docs")
'
}
}
output {
if [type] == "NET" {
elasticsearch {
hosts => "http://localhost:9200"
index => "net-%{+YYYY.MM.dd}"
ssl => "false"
}
}
If this can help !
Si ca peut aider