如題，logstash之filter處理中括號包圍的內容：

$grep -v "#" config/logstash-nlp.yml
input {
    kafka {
        bootstrap_servers => "datacollect-1:9092,datacollect-2:9092,datacollect-3:9092"
        codec => "json"
        group_id => "logstash-newtrace-nlptemp"
        topics => ["ot-nlp"]
    }
}
filter {
    grok {
        match => {
            "message" => "^\[%{GREEDYDATA:request}\]$"
        }
    }
    json {
        source => "request"
    }
 

    ruby {
        code => "event.set(‘temptime‘, event.get(‘@timestamp‘).time.localtime + 8*60*60);"
    }
    grok {
        match => ["temptime", "%{DATA:thedate}T%{NOTSPACE:thetime}Z"]
    }
}
output {
    if ([kafka][topic] =~ "^ot-nlp*") {
        if [name] == "nlp" {
            file {
                codec => line {format => "%{request}"}
                path => "/tmp/newtrace_nlp.log.%{thedate}"
            }
        }
    }
}

摘出來數組中的所有fields

filter {
    grok {
        match => {
            "message" => "^\[%{GREEDYDATA:request}\]$"
        }
    }
    json {
        source => "request"
        remove_field => [ "message", "request" ]
    }
    split {
        field => "binaryAnnotations"
    }
    json {
        source => "[binaryAnnotations][value]"
    }
}

感謝時總的大力支持！！！

核心就是正則！

logstash之filter處理中括號包圍的內容