m0_37367424
IT代码民工
2017-03-07 11:26

logstash 处理数组的一点问题

2
  • logstash
  • json
  • logstash数组

我在使用logstash处理json字符串时,在解析得到的字段数组中存在我不想让其存在的成员,试问我应该如何删除该成员,走过路过的各位大神帮个忙解决下,在此先谢过了。
处理后得到的字段如下:

 {
      "@version" => "1",
    "@timestamp" => "2017-03-07T10:42:00.140Z",
          "host" => "192.168.43.43",
          "port" => 45765,
            "id" => "00150cc4",
          "mmac" => "a2:20:a6:15:0c:c4",
          "rate" => "3",
         "wssid" => "OPPOR7s",
          "wmac" => "2e:5b:b8:be:07:4b",
          "time" => "Tue Mar 07 18:42:14 2017",
          "data" => [
        [ 0] {
              "mac" => "5e:cf:7f:93:3d:0b",
             "rssi" => "-55",
            "range" => "4.2"
        },
        [ 1] {
              "mac" => "5e:cf:7f:93:3d:0e",
             "rssi" => "-57",
            "range" => "5.0"
        },
        [ 2] {
              "mac" => "5e:cf:7f:93:3d:0f",
             "rssi" => "-55",
            "range" => "4.2"
        },
        [ 3] {
              "mac" => "5e:cf:7f:93:3d:10",
             "rssi" => "-56",
            "range" => "4.6"
        },
        [ 4] {
              "mac" => "5e:cf:7f:93:3d:0c",
             "rssi" => "-50",
            "range" => "2.7"
        },
        [ 5] {
              "mac" => "5e:cf:7f:93:3d:0d",
             "rssi" => "-50",
            "range" => "2.7"
        },
        [ 6] {
              "mac" => "9c:21:6a:fe:e9:ea",
             "rssi" => "-73",
            "range" => "19.7"
        }
    ]
}

假如我不想让data数组中mac字段为5e开头的数组元素输出,也就是让其输出如下格式,我应该怎么过滤

  {
      "@version" => "1",
    "@timestamp" => "2017-03-07T10:42:00.140Z",
          "host" => "192.168.43.43",
          "port" => 45765,
            "id" => "00150cc4",
          "mmac" => "a2:20:a6:15:0c:c4",
          "rate" => "3",
         "wssid" => "OPPOR7s",
          "wmac" => "2e:5b:b8:be:07:4b",
          "time" => "Tue Mar 07 18:42:14 2017",
          "data" => [
        [ 0] {
              "mac" => "9c:21:6a:fe:e9:ea",
             "rssi" => "-73",
            "range" => "19.7"
        }
    ]
}

顺便问下,logstash能获取数组长度么,能的话应该怎么操作呢?表示一直对logstash数组操作有点生疏。

  • 点赞
  • 回答
  • 收藏
  • 复制链接分享

1条回答

为你推荐

换一换