0

如何通过拖尾包含 JSON 数据的文件将 json 数据提取到 influx 中？

例如：

我的日志是这样的：

2020-12-01T18:34:06+02:00 10.132.90.194 {"wfd_successful_hits_sec": "0", "sql_hits_sec_max": "0", "timestamp": "2020/12/01 18:34:01", "connection_sec_max": "1922", "http_hits_sec_max": "1106", "http_hits_sec": "106", "wfd_successful_hits_sec_max": "0", "sql_hits_sec": "0", "sql_audit_phase2_events_sec_max": "0", "hdfs_hits_sec": "0", "connection_sec": "26"}

有没有办法只提取 JSON 部分并将其发送给 influx？

我知道 grok 模式(\{.*\})$会提取 JSON 部分。

我的配置如下所示：

[global_tags]
[agent]
  interval = "10s"
  round_interval = true
  metric_batch_size = 1000
  metric_buffer_limit = 10000
  collection_jitter = "0s"
  flush_interval = "10s"
  flush_jitter = "0s"
  precision = ""
  hostname = ""
  omit_hostname = false
[[inputs.tail]]
  files = ["/opt/soc/perf_stat/host*log"]
  data_format = "json"
[[outputs.influxdb_v2]]
  urls = ["http://localhost:8086"]
  token = "TOKEN"
  organization = "ORG"
  bucket = "performance_stats
4

1 回答 1

0

您可以将许多配置参数传递给您的输入插件，以告诉它如何从您的 json 结构中提取字段、标签和时间戳。见https://github.com/influxdata/telegraf/tree/master/plugins/parsers/json

于 2020-12-20T23:20:19.890 回答