一、场景描述
2. 小王的 JSON 日志是数组，需要数组中拆分出来多条日志。
二、原始日志
日志1：嵌套 JSON日志2：JSON 数组[ { "content": { "App": "App-1", "start_time": "2021-10-14T02:15:08.221", "resonsebody": { "method": "GET", "user": "Tom" }, "response_code_details": "3000", "bytes_sent": 69 } }, { "content": { "App": "App-2", "start_time": "2222-10-14T02:15:08.221", "resonsebody": { "method": "POST", "user": "Jerry" }, "response_code_details": "2222", "bytes_sent": 1 } }]{ "timestamp": 1732099684144000, "topic": "log-containers", "records": [ { "category": "kube-request", "log": "{\\"requestID\\":\\"12345\\",\\"stage\\":\\"Complete\\"}" }, { "category": "db-request", "log": "{\\"requestID\\":\\"67890\\",\\"stage\\":\\"Response\\"}" } ]}
三、加工结果
日志1日志2[{"App":"App-1","user":"Tom"},{"App":"App-2","user":"Jerry"}][{"category":"kube-request","requestID":"12345","stage":"Complete","timestamp":"1732099684144000","topic":"log-containers"},{"category":"db-request","requestID":"67890","stage":"Response","timestamp":"1732099684144000","topic":"log-containers"}]
四、DSL 加工函数
日志1：加工语句日志2：加工语句//使用 ext_json 函数从 JSON 数据中提取结构化数据，默认会平铺所有的字段ext_json("content")//丢弃 content 字段fields_drop("content")//丢弃不需要的字段 bytes_sent,method,response_code_details,start_timefields_drop("bytes_sent","method","response_code_details","start_time")//从数组中拆分日志,拆出来2条日志log_split_jsonarray_jmes("records")//丢弃原始字段recordsfields_drop("records")//展开log的KV对ext_json("log")//丢弃原始字段logfields_drop("log")