A json format known as follows, in the filter of logstash how to extract the key value of the attack-CodePudding

{" local_time ":" the 2020-03-19 06:37:42 ", "client_ip" : "192.168.188.50", "rule_tag" : "-", "attack_method" : "CC_Attack", "server_name" : "localhost", "req_url" : "\/index HTML", "req_data" : "-", "the user_agent" : "ApacheBench \/2.3"}

CodePudding user response:

 
Var logstash={" local_time ":" the 2020-03-19 06:37:42 ", "client_ip" : "192.168.188.50", "rule_tag" : "-", "attack_method" : "CC_Attack", "server_name" : "localhost", "req_url" : "\/index HTML", "req_data" : "-", "the user_agent" : "ApacheBench \/2.3"} 

The console. The log (logstash. Attack_method) 

Var logstash1={
The filter: {" local_time ":" the 2020-03-19 06:37:42 ", "client_ip" : "192.168.188.50", "rule_tag" : "-", "attack_method" : "CC_Attack", "server_name" : "localhost", "req_url" : "\/index HTML", "req_data" : "-", "the user_agent" : "ApacheBench \/2.3"} 
} 

The console. The log (logstash1. Filter. Attack_method)