是否可以在JSON中重命名子项或添加新的子键?
例如,我有这个日志输出:
{
"kubernetes": {
"pod_name": "kube-apiserver-tst",
"namespace_name": "kube-system",
"pod_id": "93a2b43a-46e6-4539-8674-06dede2619fa",
"labels": {
"component": "kube-apiserver",
"tier": "control-plane"
}
}我知道,使用record_transformer,我可以添加一个新键:
<record>
pod_labels "something ..."
</record>但是,它似乎只能在JSON的根处创建一个新键:
{
"kubernetes": {
"pod_name": "kube-apiserver-tst",
"namespace_name": "kube-system",
"pod_id": "93a2b43a-46e6-4539-8674-06dede2619fa",
"labels": {
"component": "kube-apiserver",
"tier": "control-plane"
}
"pod_labels": "something ..."
}但我能让它看起来像这样吗?
{
"kubernetes": {
"pod_name": "kube-apiserver-tst",
"namespace_name": "kube-system",
"pod_id": "93a2b43a-46e6-4539-8674-06dede2619fa",
"labels": {
"component": "kube-apiserver",
"tier": "control-plane"
}
"pod_labels": {
"component": "kube-apiserver",
"tier": "control-plane"
}
}或者这个:
{
"kubernetes": {
"pod_name": "kube-apiserver-tst",
"namespace_name": "kube-system",
"pod_id": "93a2b43a-46e6-4539-8674-06dede2619fa",
"pod_labels": {
"component": "kube-apiserver",
"tier": "control-plane"
}
}发布于 2022-02-16 18:16:41
JSON无效。一个关闭的卷发支架不见了。
下面是有效的JSON:
{
"kubernetes": {
"pod_name": "kube-apiserver-tst",
"namespace_name": "kube-system",
"pod_id": "93a2b43a-46e6-4539-8674-06dede2619fa",
"labels": {
"component": "kube-apiserver",
"tier": "control-plane"
}
}
}最小化JSON (echo '{JSON}' | jq -c .):
{"kubernetes":{"pod_name":"kube-apiserver-tst","namespace_name":"kube-system","pod_id":"93a2b43a-46e6-4539-8674-06dede2619fa","labels":{"component":"kube-apiserver","tier":"control-plane"}}}变压器过滤器插件可以与Ruby一起使用(通过红宝石选项)来操作现有的键,然后可以使用它的关键字选项删除不想要的键。
下面是示例配置:
<filter debug.test>
@type record_transformer
enable_ruby true
<record>
temp ${ l = record["kubernetes"]["labels"]; record["kubernetes"]["pod_labels"] = l; nil; }
</record>
remove_keys temp, $.kubernetes.labels
</filter>以下是完整的测试:
fluent.conf
<source>
@type forward
</source>
<filter debug.test>
@type record_transformer
enable_ruby true
<record>
temp ${ l = record["kubernetes"]["labels"]; record["kubernetes"]["pod_labels"] = l; nil; }
</record>
remove_keys temp, $.kubernetes.labels
</filter>
<match debug.test>
@type stdout
</match>使用此配置启动fluentd:
fluentd -c fluent.conf在另一个终端上,用fluent-cat (echo '{JSON}' | fluent-cat debug.test)发送一个事件:
echo '{"kubernetes":{"pod_name":"kube-apiserver-tst","namespace_name":"kube-system","pod_id":"93a2b43a-46e6-4539-8674-06dede2619fa","labels":{"component":"kube-apiserver","tier":"control-plane"}}}' | fluent-cat debug.test在fluentd日志中,您应该看到所需的输出:
2022-02-16 23:08:25.919967225 +0500 debug.test: {"kubernetes":{"pod_name":"kube-apiserver-tst","namespace_name":"kube-system","pod_id":"93a2b43a-46e6-4539-8674-06dede2619fa","pod_labels":{"component":"kube-apiserver","tier":"control-plane"}}}使用jq (echo '{JSON}' | jq .)格式化输出:
echo '{"kubernetes":{"pod_name":"kube-apiserver-tst","namespace_name":"kube-system","pod_id":"93a2b43a-46e6-4539-8674-06dede2619fa","pod_labels":{"component":"kube-apiserver","tier":"control-plane"}}}' | jq .输出:
{
"kubernetes": {
"pod_name": "kube-apiserver-tst",
"namespace_name": "kube-system",
"pod_id": "93a2b43a-46e6-4539-8674-06dede2619fa",
"pod_labels": {
"component": "kube-apiserver",
"tier": "control-plane"
}
}
}https://stackoverflow.com/questions/71129267
复制相似问题