Logstash“变异-无法将“ false”转换为布尔值”

问题描述

我目前正在从API中提取Logstash（7.8.1）配置中的json，然后对其进行过滤，然后将其输出到Elasticsearch。对于初学者来说，对我的API的简单curl调用将输出以下我试图在logstash配置文件的过滤器部分中清除的json：

{
"numRowsToRead": "5000","cosmosDocCount": "\"5000\"","totalFragmentCount": 5000,"lastSuccessfulBatchTimestamp": "\"null\"","streamingDriven": "\"false\"","totalRows": "5000","lastBatchId": "\"null\"","status": "TASK_FINISHED","samplingRatio": 1.0,"mergeStrategy": "timestampOrdered_pdg","lastSampledTimestamp": "2020-07-31 19:45:03.0"
}

我在这里遇到的问题是在streamingDriven属性上，因为我希望它的类型为 boolean 而不是 string ，因此我更新了使用以下内容过滤配置：

mutate{
    gsub => ["streamingDriven","\"",""]
    convert      => {
                    "streamingDriven" => "boolean"
                    "totalRows" => "integer"
                    "numRowsToRead" => "integer"
                    "cosmosDocCount" => "integer"
                    }
    remove_field => ["@version","http_poller_metadata"]
}

由于某些未知原因，streamingDriven仍然是 string ，我看到了日志输出：

[WARN ] 2020-08-10 19:59:52.612 [[main]>worker1] mutate - Failed to convert "false" into boolean.
{
                 "streamingDriven" => "false","cosmosDocCount" => 0,"numRowsToRead" => 5000,"lastSuccessfulBatchTimestamp" => "\"null\"","lastBatchId" => "\"null\"","mergeStrategy" => "timestampOrdered_pdg","totalFragmentCount" => 5000,"status" => "TASK_FINISHED","totalRows" => 5000,"samplingRatio" => 1.0,"lastSampledTimestamp" => "2020-07-31 19:45:03.0","@timestamp" => 2020-08-01T02:45:03.000Z
}

documentation似乎表明"streamingDriven" => "boolean"应该将boolean类型的“ false”转换为false，而我试图弄清楚为什么它对我不起作用。有什么想法我做错了吗？

解决方法

我想出了需要做些什么才能使它工作。诀窍是像这样使用第二个变异：

mutate{
        add_field => {
            streaming_driven => "%{streamingDriven}"
        }
        gsub => ["streamingDriven","\"",""]
}
mutate{
    convert => {
        "streaming_driven" => "boolean"
    }
    remove_field => ["@version","http_poller_metadata"]
}

现在我得到一个布尔值。