logstash拆分数据并将数据发送到多个输出

参考文章 使用 Logstash 拆分数据并将数据发送到多个输出

 编辑conf文件

input{
  #使用http_poller定时从接口拉取数据
  http_poller {
    urls => {
      # 表示第一个url是test1
      test1 => {
        method => "GET"
        body => '{"stock_code":"000001","length":"1"}'
        # 如果需要认证的话，这样加
        user => "AzureDiamond"
        password => "hunter2"
        url => "http://49.232.109.48:8888/1/get_minute_kline"
        headers => {
          Accept => "*"
        }
      }
    }
    request_timeout => 60
    # 每15秒运行一次，Supports "cron", "every", "at" and "in" schedules by rufus scheduler
    schedule => {"every" => "15s"}
    # 结果转换为json
    codec => "json"
  }
}
filter {
  # 创建两个副本1和2，不开启ecs会生成tag字段，开启会生成tags字段
  clone {
    clones => ["1","2"]
  }
  # 运行ruby脚本
  ruby{
    path => "/etc/logstash/test.rb"
    script_params => {}
  }
  # 移除多余字段
  mutate {
    remove_field => [ "@version","event","data" ]
  }

}
output{
  #输出到stdout
  stdout{}
}

ruby脚本内容

# the value of `params` is the value of the hash passed to `script_params`
# in the logstash configuration
# conf文件的script_params会传输到这
def register(params)
  # @param=params["param"]
end

# the filter method receives an event and must return a list of events.
# Dropping an event means not including it in the return array,
# while creating new ones only requires you to add a new instance of
# LogStash::Event to the returned array
def filter(event)
  #从event中获取data字段(edata是个array[hash])
  edata = event.get("data")
  #将stock_code和price字段提取出来
  event.set("stock_code", edata[0]["stock_code"])
  event.set("price", edata[0]["close"])
  return [event]
end