2013-12-09 53 views
2

我在解析下面的json文件時遇到了問題。我想解析這個使用logstash/python。解析python中的json

{ 
    "took" : 153, 
    "timed_out" : false, 
    "_shards" : { 
    "total" : 5, 
    "successful" : 5, 
    "failed" : 0 
    }, 
    "hits" : { 
    "total" : 946, 
    "max_score" : 1.0, 
    "hits" : [ { 
     "_index" : "incoming_bytes", 
     "_type" : "logs", 
     "_id" : "lZSq4mBRSVSxO0kyTwh3fQ", 
     "_score" : 1.0, "_source" : {"user_id":"86c8c25d81a448c49e3d3924ea5ceddf","name":"network.incoming.bytes","resource_id":"instance-00000001-c8be5ca1-116b-45b3-accb-1b40050abc90-tapaf1e421f-c8","timestamp":"2013-11-02T07:32:36Z","resource_metadata":{"name":"tapaf1e421f-c8","parameters":{},"fref":null,"instance_id":"c8be5ca1-116b-45b3-accb-1b40050abc90","instance_type":"5c014e54-ee16-43a8-a763-54e243bd8969","mac":"fa:16:3e:67:39:29"},"volume":557462,"source":"openstack","project_id":"9ac587404bdd4fcdafe41c0b10f9f8ae","type":"cumulative","id":"f1eb19aa-4390-11e3-8bac-000c2973cfb1","unit":"B","@timestamp":"2013-11-02T07:32:38.276Z","@version":"1","host":"127.0.0.1","tags":["_grokparsefailure"],"priority":13,"severity":5,"facility":1,"facility_label":"user-level","severity_label":"Notice","@type":"%{appdeliveryserver}"} 
    }, { 
     "_index" : "incoming_bytes", 
     "_type" : "logs", 
     "_id" : "073URWt5Sc-krLACxQnI3g", 
     "_score" : 1.0, "_source" : {"user_id":"86c8c25d81a448c49e3d3924ea5ceddf","name":"network.incoming.bytes","resource_id":"instance-00000001-c8be5ca1-116b-45b3-accb-1b40050abc90-tapaf1e421f-c8","timestamp":"2013-11-02T07:32:38Z","resource_metadata":{"name":"tapaf1e421f-c8","parameters":{},"fref":null,"instance_id":"c8be5ca1-116b-45b3-accb-1b40050abc90","instance_type":"5c014e54-ee16-43a8-a763-54e243bd8969","mac":"fa:16:3e:67:39:29"},"volume":562559,"source":"openstack","project_id":"9ac587404bdd4fcdafe41c0b10f9f8ae","type":"cumulative","id":"f31e38d4-4390-11e3-8bac-000c2973cfb1","unit":"B","@timestamp":"2013-11-02T07:32:39.001Z","@version":"1","host":"127.0.0.1","tags":["_grokparsefailure"],"priority":13,"severity":5,"facility":1,"facility_label":"user-level","severity_label":"Notice","@type":"%{appdeliveryserver}"} 
    }] 
    } 
} 

我已經使用logstash下面的配置,但預期其是配置不起作用:在JSON文件,並輸出到STDOUT在解析各個字段。

input { 
stdin{} 
    file { 

     path => ["/home/****/Downloads/throughput"] 
     codec => "json" 
    } 
} 
filter{ 
    json{ 

     source => "message" 
     target => "throughput" 

    } 
} 
output { 
    stdout {codec => rubydebug } 

} 

對於Python我想訪問單個卷和源(IP地址)字段。

我試了下面的代碼,目標是爲每個記錄映射單個字段,並且我想知道如何繼續以遍歷和提取​​列表中的單個元素。

import json 
from pprint import pprint 

json_data=open('throughput') 

data = json.load(json_data) 

pprint(data["hits"]) 

json_data.close() 

感謝

+3

你是什麼確切的問題?即什麼不工作,以什麼方式? – alko

+0

Logstash:Logstash不提供任何輸出到標準輸出,我檢查了json驗證器並且格式是有效的。 Python:我想知道如何繼續遍歷和提取​​單個字段。 –

回答

3

解析的JSON是一個dictionary,您可以使用itemgetter向下鑽取。

例如,對於容積

>>> for hits in data['hits']['hits']: 
...  print hits['_source']['volume'] 
... 
557462 
562559 

或者可以使用map獲取列表:

>>> from operator import itemgetter 
>>> map(itemgetter('volume'), map(itemgetter('_source'), data['hits']['hits'])) 
[557462, 562559] 
+0

謝謝,昨天本身就工作。因爲它的工作原理,我對Logstash中的失敗也有想法。任何意見? –