0

Logstash version: 7.17.10 Elasticsearch version:7.17.10

The logs are located in /var/logs directory and the format is as below:

[
  {
    "t": "SYS",
    "dt": "2023-04-17 19:46:40.147 GMT-04:00",
    "c": "MenuSectionsViewController",
    "cpu": "cpu usage: 40%",
    "m": "dealloc",
    "msg": "",
    "mem": "total: 4177M used: 169M free: 2398M",
    "b": "8.25.1"
  },
  {
    "t": "SYS",
    "dt": "2023-04-17 19:46:40.154 GMT-04:00",
    "c": "OrderTicketView",
    "cpu": "cpu usage: 40%",
    "m": "dealloc",
    "msg": "",
    "mem": "total: 4177M used: 169M free: 2398M",
    "b": "8.25.1"
  }
]

I want to use Logstash to parse JSON arrays in log files and output each JSON object as a separate document to Elasticsearch. But unfortunately, I have tried multiple configurations and still haven't found the right solution, so I hope everyone can help me out.

My expected log documents are as follows:

{
  "_index": "device-logs-2023.07.28",
  "_type": "_doc",
  "_id": "VVqImokBM0y425kVF-bp",
  "_version": 1,
  "_score": 1,
  "_source": {
    "path": "/var/logs/2.log",
    "tags": [
      "multiline",
      "_jsonparsefailure"
    ],
    "@timestamp": "2023-07-28T03:25:57.330Z",
    "host": "2b9233260805",
    "@version": "1",
    "message": {
          "t":"SYS",
          "dt": "2023-04-17 19:46:40.147 GMT-04:00",
           "c": "MenuSectionsViewController"
            ....
       }

  }
...
fisherhe
  • 1
  • 2

0 Answers0