[{"content": {"App": "App-1","start_time": "2021-10-14T02:15:08.221","resonsebody": {"method": "GET","user": "Tom"},"response_code_details": "3000","bytes_sent": 69}},{"content": {"App": "App-2","start_time": "2222-10-14T02:15:08.221","resonsebody": {"method": "POST","user": "Jerry"},"response_code_details": "2222","bytes_sent": 1}}]
{"timestamp": 1732099684144000,"topic": "log-containers","records": [{"category": "kube-request","log": "{\\"requestID\\":\\"12345\\",\\"stage\\":\\"Complete\\"}"},{"category": "db-request","log": "{\\"requestID\\":\\"67890\\",\\"stage\\":\\"Response\\"}"}]}
[{"App":"App-1","user":"Tom"},{"App":"App-2","user":"Jerry"}]
[{"category":"kube-request","requestID":"12345","stage":"Complete","timestamp":"1732099684144000","topic":"log-containers"},{"category":"db-request","requestID":"67890","stage":"Response","timestamp":"1732099684144000","topic":"log-containers"}]
//ext_json関数を使用してJSONデータから構造化データを抽出します。デフォルトではすべてのフィールドがフラット化されます。ext_json("content")//contentフィールドを破棄します。fields_drop("content")//不要なフィールドbytes_sent,method,response_code_details,start_timeを破棄します。fields_drop("bytes_sent","method","response_code_details","start_time")
//配列からログを分割し、2件のログを取り出します。log_split_jsonarray_jmes("records")//元のフィールドrecordsを破棄します。fields_drop("records")//logのKVペアを展開します。ext_json("log")//元のフィールドlogを破棄します。fields_drop("log")
フィードバック