Logstash – 根据包含数组中的对象将事件拆分为两个

我正在第一次使用logstash，我试图从amavisd-new中接收JSON报告进行search和分析。 Amavisd-new能够将json日志写入到redis中，并且我已经完全导入了所有的东西，并且已经开始通过所有这些学习我的方式了。

但是我有一个问题 – amavis的JSON报告的格式如下所示 – 注意“收件人”有一个数组，每个收件人有一个条目。

我想把整个事件分成两个 – 每个收件人一个，所有其他字段保持不变，但是将每个收件人数组成员的“action”，“ccat_main”，“queued_as”等字段replace为主甚至。

这个想法是，有两个收件人的传入事件会导致logstash中有两个单独的日志事件 – 每个人都有一个事件。

• Marathon event stream => Logstash
• Nginx的远程访问日志
• Logstash netflow插件configuration错误
• Logstashfilter：syslog_pri总是默认通知？
• Logstash系统日志filter不适用于日志？

我已经看到分裂的事件，但我没有看到如何做到这一点 – 我似乎无法find任何适当的例子。

所以，对于真实的例子，给定这个：

{ "@timestamp" => "2014-05-06T09:29:47.048Z", "time_unix" => 1399368587.048, "time_iso_week_date" => "2014-W19-2", "partition" => "19", "type" => "amavis", "host" => "mailer.example.net", "queued_as" => ["3gNFyR4Mfjzc3", "3gNFyR4n6Lzc4"], "recipients" => [ { "action" => "PASS", "ccat_main" => "Clean", "queued_as" => "3gNFyR4Mfjzc3", "rcpt_is_local" => false, "rcpt_to" => "[email protected]", "smtp_code" => "250", "smtp_response" => "250 2.0.0 from MTA(smtp:[::1]:10013): 250 2.0.0 Ok: queued as 3gNFyR4Mfjzc3", "spam_score" => -2.0 }, { "action" => "PASS", "ccat_main" => "Clean", "mail_id_related" => "men7HTERZaOF", "penpals_age" => 1114599, "queued_as" => "3gNFyR4n6Lzc4", "rcpt_is_local" => true, "rcpt_to" => "[email protected]", "smtp_code" => "250", "smtp_response" => "250 2.0.0 from MTA(smtp:[::1]:10013): 250 2.0.0 Ok: queued as 3gNFyR4n6Lzc4", "spam_score" => -5.272 } ], "smtp_code" => ["250"], } 

我想结束两个不同的事件，像这样：

  { "@timestamp" => "2014-05-06T09:29:47.048Z", "time_unix" => 1399368587.048, "time_iso_week_date" => "2014-W19-2", "partition" => "19", "type" => "amavis", "host" => "mailer.example.net", "queued_as" => ["3gNFyR4Mfjzc3", "3gNFyR4n6Lzc4"], "action" => "PASS", "ccat_main" => "Clean", "queued_as" => "3gNFyR4Mfjzc3", "rcpt_is_local" => false, "rcpt_to" => "[email protected]", "smtp_code" => "250", "smtp_response" => "250 2.0.0 from MTA(smtp:[::1]:10013): 250 2.0.0 Ok: queued as 3gNFyR4Mfjzc3", "spam_score" => -2.0 "smtp_code" => ["250"], } 

和

  { "@timestamp" => "2014-05-06T09:29:47.048Z", "time_unix" => 1399368587.048, "time_iso_week_date" => "2014-W19-2", "partition" => "19", "type" => "amavis", "host" => "mailer.example.net", "queued_as" => ["3gNFyR4Mfjzc3", "3gNFyR4n6Lzc4"], "recipients" => [ "action" => "PASS", "ccat_main" => "Clean", "mail_id_related" => "men7HTERZaOF", "penpals_age" => 1114599, "queued_as" => "3gNFyR4n6Lzc4", "rcpt_is_local" => true, "rcpt_to" => "[email protected]", "smtp_code" => "250", "smtp_response" => "250 2.0.0 from MTA(smtp:[::1]:10013): 250 2.0.0 Ok: queued as 3gNFyR4n6Lzc4", "spam_score" => -5.272 "smtp_code" => ["250"], } 

我怎样才能做到这一点？

谢谢-

汤姆