1
JSONファイルを解析し、変異:はLogstash - 以下のJSONファイル持つ
{
"count": 2,
"status": {"partial": true},
"records": [
{
"info": {
"startTime": "2016-07-17 08:42:40.212+0000",
"endTime": "2016-07-17 08:43:47.715+0000",
"id": "123456789"
},
"conversation": {
"lines": [
{
"time": "2016-07-17 08:42:32.533+0000",
"text": "Hi There",
"user": "user A"
},
{
"time": "2016-07-17 08:42:36.533+0000",
"text": "Hello",
"user": "user B"
}
]
}
},
{
"info": {
"startTime": "2016-07-18 08:42:40.212+0000",
"endTime": "2016-07-18 08:43:47.715+0000",
"id": "4567890"
},
"conversation": {
"lines": [
{
"time": "2016-07-17 08:42:32.533+0000",
"text": "Hi There",
"user": "user X"
},
{
"time": "2016-07-17 08:42:36.533+0000",
"text": "Hello",
"user": "user Y"
}
]
}
}
]
}
をEDIT(RAW形式):
{"count": 20,"status": {"partial": true},"records": [{"info": {"startTime": "2016-07-17 08:42:40.212+0000","endTime": "2016-07-17 08:43:47.715+0000","id": "123456789"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user A"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user B"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}},
{"info": {"startTime": "2016-07-18 08:42:40.212+0000","endTime": "2016-07-18 08:43:47.715+0000","id": "4567890"},"conversation": {"lines": [{"time": "2016-07-17 08:42:32.533+0000","text": "Hi There","user": "user X"},{"time": "2016-07-17 08:42:36.533+0000","text": "Hello","user": "user Y"}]}}
]}
私はの残りの部分を無視して(conversation.lines
をインポートするlogstashを使用したいです情報をinfo
のように)レコードごとに作成し、時間プロパティに応じていくつかの行を削除するようなロジックを実行することもできます。
Logstashだけでも可能ですか、それともファイルを前処理する必要がありますか?
これらのJSONドキュメントは1行にあるのか、上に示したようにきれいに印刷されていますか? – Val
各docはきれいに印刷されていない行ですが、最初の行には数とステータスフィールドが含まれています –
処理したいファイルでJSONデータ**がどのように見えるかを表示できますか? – Val