filter-json：http://www.logstash.net/docs/1.4.2/filters/json

json数据：

{"account_number":995,"balance":21153,"firstname":"Phelps","lastname":"Parrish","age":25,"gender":"M","address":"666 Miller Place","employer":"Pearlessa","email":"phelpsparrish@pearlessa.com","city":"Brecon","state":"ME"}

logjson.conf文件：

input {
file {
  type => "accounts"
  path => "D:/logsystem/logstash/bin/test/accounts.txt"

start_position => "beginning"

}
}

filter {

    json{
	source => "message"
    
     }


}

output {
      stdout{
	codec => rubydebug
	}
#无法解析的json不记录到elasticsearch中
if "_jsonparsefailure" not in [tags] {
  elasticsearch {
    host => "localhost"
  }
}

}

结果如下：

View: Table / JSON / Raw
{
  "_index": "logstash-2014.12.12",
  "_type": "accounts",
  "_id": "7LEXwMOPQp-FrvJrrRO6Yw",
  "_score": 1,
  "_source": {
    "message": "{\"account_number\":903,\"balance\":10238,\"firstname\":\"Wade\",\"lastname\":\"Page\",\"age\":35,\"gender\":\"F\",\"address\":\"685 Waldorf Court\",\"employer\":\"Eplosion\",\"email\":\"wadepage@eplosion.com\",\"city\":\"Welda\",\"state\":\"AL\"}",
    "@version": "1",
    "@timestamp": "2014-12-12T14:22:30.109Z",
    "type": "accounts",
    "host": "huangwen",
    "path": "D:/logsystem/logstash/bin/test/accounts.txt",
    "account_number": 903,
    "balance": 10238,
    "firstname": "Wade",
    "lastname": "Page",
    "age": 35,
    "gender": "F",
    "address": "685 Waldorf Court",
    "employer": "Eplosion",
    "email": "wadepage@eplosion.com",
    "city": "Welda",
    "state": "AL"
  }
}

本文出自 “尽管错，让我错到死！” 博客，请务必保留此出处http://hxw168.blog.51cto.com/8718136/1589486

【logstash】 - 使用json解析数据