对电脑日志复杂的键值对提取 每个json数据不一样要求通用脚本模板

Question

_source
"{'@timestamp': '2020-09-21T00:46:21.676Z', 'service': {'type': 'system'}, 'ecs': {'version': '1.5.0'}, 'host': {'name': 'DESKTOP-B8KO4F2'}, 'agent': {'type': 'auditbeat', 'version': '7.8.0', 'hostname': 'DESKTOP-B8KO4F2', 'ephemeral_id': '4e9babb5-fe64-492c-bfee-60bc48d5ecbb', 'id': '6c8b1fa8-661a-4cd7-a982-6a5104deb6e7', 'name': 'DESKTOP-B8KO4F2'}, 'event': {'kind': 'event', 'category': ['process'], 'type': ['start'], 'action': 'process_started', 'module': 'system', 'dataset': 'process'}, 'process': {'args': ['C:\Windows\system32\SearchFilterHost.exe', '0', '736', '740', '748', '8192', '744'], 'pid': 6196, 'start': '2020-09-21T00:46:12.450Z', 'hash': {'sha1': '38998a827eb2e7b4879bc4e8b09de632793e4976'}, 'ppid': 7776, 'working_directory': 'C:\Windows\system32', 'entity_id': 'kOE5rcBfgspO0Juc', 'name': 'SearchFilterHost.exe', 'executable': 'C:\Windows\System32\SearchFilterHost.exe'}, 'message': 'Process SearchFilterHost.exe (PID: 6196) by user NT AUTHORITY\SYSTEM STARTED', 'user': {'group': {'id': 'S-1-5-18'}, 'name': 'NT AUTHORITY\SYSTEM', 'id': 'S-1-5-18'}}"

Answer 1

可以遍历每个日志读取成字符串进行处理，单个可这样：

import pandas as pd
d=eval(s)
df=pd.DataFrame(d)
print(df)

如有帮助，请点采纳。