当我尝试为数组传递更深的引用时，拆分似乎引发错误

如何解决当我尝试为数组传递更深的引用时，拆分似乎引发错误

我有一些简单的代码：

{ "bustime-response": { "vehicle": [ {"vid": "foo"}] }}

当我尝试运行我设置的conf文件时，它将崩溃。我认为这与拆分字段的要求有关，但是我不确定发生了什么。

split {
  field => "[bustime-response][vehicle]"
}

删除拆分时，系统将记录完整的json对象，但是我试图为每个“车辆”创建单独的事件，而每个“车辆”都以“ vid”作为主键，因为可能有多个车辆一条路线。

在处理JSON时，我在这里缺少什么吗？我正在查看拆分文档，该字段的信息为：

其值由终止符分隔的字段。可以是多行消息或数组的ID。嵌套数组的引用类似于：“ [object_id] [array_id]”

我的Docker容器中的日志是：

[ERROR] 2020-10-12 19:14:14.450 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main,:exception=>"LogStash::ConfigurationError",:message=>"Expected one of [ \\t\\r\\n],\"#\",\"input\",\"filter\",\"output\" at line 12,column 1 (byte 270) after ",:backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'","org/logstash/execution/AbstractPipelineExt.java:183:in `initialize'","org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'","/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:44:in `initialize'","/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'","/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357:in `block in converge_state'"]}
[INFO ] 2020-10-12 19:14:14.554 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2020-10-12 19:14:19.590 [LogStash::Runner] runner - Logstash shut down.

解决方法

像mutate这样的

分割需要存在于“过滤器”块内。它们不是独立的选项。