Logstash：斯普利特JSON對象

-1

請我有一個XML輸入產生一個JSON對象，它看起來像這樣：Logstash：斯普利特JSON對象

{ 
    "@version" => "1", 
"@timestamp" => "2016-04-11T15:35:07.372Z", 
     "host" => "YUSUF-PC", 
    "command" => "nana", 
     "doc" => { 
    "TotalResults" => "1892", 
      "Audit" => [ 
     [0] { 
        "Id" => "2260167", 
       "Action" => "UPDATE", 
       "ParentId" => "30612", 
      "ParentType" => "defect", 
        "Time" => "2016-01-04 08:27:59", 
        "User" => "nana", 
      "Properties" => { 
       "Property" => [ 
        [0] { 
          "Label" => "Statut", 
          "Name" => "status", 
         "NewValue" => [ 
          [0] "En cours" 
         ] 
        }, 
        [1] { 
          "Label" => "Affecté à", 
          "Name" => "owner", 
         "NewValue" => [ 
          [0] "nana" 
         ] 
        }, 
        [2] { 
          "Label" => "Priorité", 
          "Name" => "severity", 
         "NewValue" => [ 
          [0] "nana" 
         ] 
        } 
       ] 
      } 
     }, 
     [1] { 
        "Id" => "2260168", 
       "Action" => "UPDATE", 
       "ParentId" => "30612", 
      "ParentType" => "defect", 
        "Time" => "2016-01-04 09:45:33", 
        "User" => "nana", 
      "Properties" => { 
       "Property" => [ 
        [0] { 
          "Label" => "Affecté à", 
          "Name" => "owner", 
         "NewValue" => [ 
          [0] "nana" 
         ], 
         "OldValue" => [ 
          [0] "nana" 
         ] 
        } 
       ] 
      } 
     } 
    ] 
} }

我需要這個JSON拆分性質，即獲取包含一個屬性的每個文檔，問題不是分割操作，但是當我將它插入到elasticsearch時，「NewValue」字段沒有考慮到......所以我需要編寫一個紅寶石過濾器來將值更改爲值[0]。任何人都可以幫忙，我不擅長紅寶石？

我想這樣一個JSON：

{ 
    "@version" => "1", 
"@timestamp" => "2016-04-11T15:35:07.372Z", 
     "host" => "YUSUF-PC", 
    "command" => "nana", 
     "doc" => { 
    "TotalResults" => "1892", 
      "Audit" => [ 
     [0] { 
        "Id" => "2260167", 
       "Action" => "UPDATE", 
       "ParentId" => "30612", 
      "ParentType" => "defect", 
        "Time" => "2016-01-04 08:27:59", 
        "User" => "nana", 
      "Properties" => { 
       "Property" => 
        { 
          "Label" => "Statut", 
          "Name" => "status", 
         "NewValue" => "En cours" 
         }        
        } 
       } 

      ] 
     } 
     }

謝謝

來源

2016-04-11 Youssef El Rhailani

歡迎來到Stack Overflow。請閱讀「[問]」，包括最終鏈接和「[mcve]」。我們希望看到您爲解決此問題所做的努力，無論是作爲您撰寫的最低代碼，還是您搜索的內容以及這些網頁無法提供幫助的原因。現在看起來你希望我們爲你寫信。另外，你的「示例」JSON不是JSON，它是一個Ruby哈希，看起來像是來自IRB。 –

我不想讓你爲我寫，我盡我所能，但我不是Ruby的專家，之前提到的JSON是logstash輸入的結果，logstash標籤非常清晰。這很粗魯@theTinMan –

我希望這有助於。

old = { 
"@version" => "1", 
"@timestamp" => "2016-04-11T15:35:07.372Z", 
    "host" => "YUSUF-PC", 
    "command" => "nana", 
    "doc" => { 
    "TotalResults" => "1892", 
     "Audit" => [ 
     { 
       "Id" => "2260167", 
       "Action" => "UPDATE", 
       "ParentId" => "30612", 
       "ParentType" => "defect", 
       "Time" => "2016-01-04 08:27:59", 
       "User" => "nana", 
       "Properties" => { 
        "Property" => [ 
       { 
         "Label" => "Statut", 
         "Name" => "status", 
         "NewValue" => [ 
         "En cours" 
        ] 
       }, 
       { 
         "Label" => "Affecté à", 
         "Name" => "owner", 
        "NewValue" => [ 
         "nana" 
        ] 
       }, 
       { 
         "Label" => "Priorité", 
         "Name" => "severity", 
        "NewValue" => [ 
         "nana" 
        ] 
       } 
      ] 
     } 
    }, 
    { 
       "Id" => "2260168", 
      "Action" => "UPDATE", 
      "ParentId" => "30612", 
     "ParentType" => "defect", 
       "Time" => "2016-01-04 09:45:33", 
       "User" => "nana", 
     "Properties" => { 
      "Property" => [ 
       { 
         "Label" => "Affecté à", 
         "Name" => "owner", 
        "NewValue" => [ 
         "nana" 
        ], 
        "OldValue" => [ 
         "nana" 
        ] 
       } 
      ] 
      } 
     } 
    ] 
    } } 

    ##THIS IS THE LINE ACTUALLY DOING WORK. 
    old["doc"]["Audit"].map{|prop| prop["Properties"]["Property"].map{|value| value['NewValue']= value['NewValue'].first} } 
    old 
    => {"@version"=>"1", "@timestamp"=>"2016-04-11T15:35:07.372Z", "host"=>"YUSUF-PC", "command"=>"nana", "doc"=>{"TotalResults"=>"1892", "Audit"=>[{"Id"=>"2260167", "Action"=>"UPDATE", "ParentId"=>"30612", "ParentType"=>"defect", "Time"=>"2016-01-04 08:27:59", "User"=>"nana", "Properties"=>{"Property"=>[{"Label"=>"Statut", "Name"=>"status", "NewValue"=>"En cours"}, {"Label"=>"Affecté à", "Name"=>"owner", "NewValue"=>"nana"}, {"Label"=>"Priorité", "Name"=>"severity", "NewValue"=>"nana"}]}}, {"Id"=>"2260168", "Action"=>"UPDATE", "ParentId"=>"30612", "ParentType"=>"defect", "Time"=>"2016-01-04 09:45:33", "User"=>"nana", "Properties"=>{"Property"=>[{"Label"=>"Affecté à", "Name"=>"owner", "NewValue"=>"nana", "OldValue"=>["nana"]}]}}]}}

來源

2016-04-11 17:18:05

非常感謝 –

Logstash：斯普利特JSON對象

回答

相關問題