如何解决Logstash“变异-无法将“ false”转换为布尔值”
我目前正在从API中提取Logstash(7.8.1)配置中的json,然后对其进行过滤,然后将其输出到Elasticsearch。对于初学者来说,对我的API的简单curl调用将输出以下我试图在logstash配置文件的过滤器部分中清除的json:
{
"numRowsToRead": "5000","cosmosDocCount": "\"5000\"","totalFragmentCount": 5000,"lastSuccessfulBatchTimestamp": "\"null\"","streamingDriven": "\"false\"","totalRows": "5000","lastBatchId": "\"null\"","status": "TASK_FINISHED","samplingRatio": 1.0,"mergeStrategy": "timestampOrdered_pdg","lastSampledTimestamp": "2020-07-31 19:45:03.0"
}
我在这里遇到的问题是在streamingDriven
属性上,因为我希望它的类型为 boolean 而不是 string ,因此我更新了使用以下内容过滤配置:
mutate{
gsub => ["streamingDriven","\"",""]
convert => {
"streamingDriven" => "boolean"
"totalRows" => "integer"
"numRowsToRead" => "integer"
"cosmosDocCount" => "integer"
}
remove_field => ["@version","http_poller_metadata"]
}
由于某些未知原因,streamingDriven
仍然是 string ,我看到了日志输出:
[WARN ] 2020-08-10 19:59:52.612 [[main]>worker1] mutate - Failed to convert "false" into boolean.
{
"streamingDriven" => "false","cosmosDocCount" => 0,"numRowsToRead" => 5000,"lastSuccessfulBatchTimestamp" => "\"null\"","lastBatchId" => "\"null\"","mergeStrategy" => "timestampOrdered_pdg","totalFragmentCount" => 5000,"status" => "TASK_FINISHED","totalRows" => 5000,"samplingRatio" => 1.0,"lastSampledTimestamp" => "2020-07-31 19:45:03.0","@timestamp" => 2020-08-01T02:45:03.000Z
}
documentation似乎表明"streamingDriven" => "boolean"
应该将boolean类型的“ false”转换为false,而我试图弄清楚为什么它对我不起作用。有什么想法我做错了吗?
解决方法
我想出了需要做些什么才能使它工作。诀窍是像这样使用第二个变异:
mutate{
add_field => {
streaming_driven => "%{streamingDriven}"
}
gsub => ["streamingDriven","\"",""]
}
mutate{
convert => {
"streaming_driven" => "boolean"
}
remove_field => ["@version","http_poller_metadata"]
}
现在我得到一个布尔值。
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。