JSON 日志
JSON 是一种开放标准文件格式，以人类可读的方式传输由属性-值对组成的数据对象。由于其结构化的数据格式以及易于解析的特点，JSON 被广泛采用。JSON 还具有紧凑、易于在大多数日志框架中实现的优点。Site24x7 支持解析单行和多行 JSON 日志，并支持普通日志与 JSON 日志模式的组合。您可以使用 Site24x7 Applogs 跟踪和监控这些日志。
入门
单行 JSON
日志示例
{"machineTimeUTC":"2019-01-01T09:27:11.620Z","id":"661dc0ae-404b-4f0d-9579-ceca6e20f22c","callCenterName":"DEV-Station","name":"A","value":100,"stack":"dev","machineTime":"2019-01-01T11:27:11.620+02:00"}
日志模式
以下是 Site24x7 识别的用于解析 JSON 日志示例的默认模式。日志模式应以关键字 json 开头，并且至少包含一个日期字段。
json $stack$ $machineTimeUTC as MachineTime:date:yyyy-MM-dd'T'HH:mm:ss.SSS'Z'$ $callCenterName as CallCenter$ $name$ $id$
如果您希望更改字段名称，例如将 callCenterName 改为 CallCenter，请使用 as 关键字。此外，如果您想从 JSON 日志中排除某个字段，可以从日志模式中将其删除。
该日志将被拆分为多个字段，每个字段取其对应的值，然后上传至 Site24x7。
| 字段名称 | 字段值 |
| stack | dev |
| MachineTime | 2019-01-01T09:27:11.620Z |
| CallCenter | DEV-Station |
| name | A |
| id | 661dc0ae-404b-4f0d-9579-ceca6e20f22c |
多行 JSON
日志示例
{
"_index": "keepalive-2019-01-01",
"_type": "logs",
"_id": "49590436630844818814950698841516754273392947672976982018.0",
"_score": 1.5,
"_source": {
"logType": "Keepalive",
"machineData": {
"name": "A",
"callCenterName": "DEV-Station",
"machineTimeUTC": "2019-01-01T09:27:11.620Z",
"id": "661dc0ae-404b-4f0d-9579-ceca6e20f22c",
"stack": "dev",
"machineTime": "2019-01-01T11:27:11.620+02:00"
}
},
"fields": {
"nameid": [
"DEV-Station = B"
],
"machineData.machineTimeUTC": [
1546334831620
],
"machineData.machineTime": [
1546334831620
]
}
}
日志模式
您可以使用以下日志模式从示例日志中收集 JSON 对象 machineData。
json $_source.machineData.stack as Stack$ $_source.machineData.machineTimeUTC as DateTime:date$ $_source.machineData.callCenterName as CenterName$ $_source.machineData.name as Name$ $_source.machineData.id as Id$
| 字段名称 | 字段值 |
| Stack | dev |
| DateTime | 2019-01-01T09:27:11.620Z |
| CenterName | DEV-Station |
| Name | A |
| Id | 661dc0ae-404b-4f0d-9579-ceca6e20f22c |
您可以使用以下日志模式收集其他数据对象，如 _score 和 _source.logType。
json $_source.machineData.stack as Stack$ $_source.machineData.machineTimeUTC as DateTime:date$ $_source.machineData.callCenterName as CenterName$ $_source.machineData.name as Name$ $_source.machineData.id as Id$ $_source.logType as logtypes$ $_score as score:number$
普通日志与 JSON 日志模式的组合
日志示例
2022/06/06 09:13:38 vagrant program[123]: server.1 {"method":"GET", "status_code":200, "url":"https://zylker.com/logs/pipelines", "duration":123456}
日志模式
以下日志模式包含普通格式与 JSON 格式日志的组合：
$Date:date$ vagrant program[123]: server.1 $Message:json:$method$ $status_code:number$ $url$ $duration:number$$
该日志模式仅支持单行 JSON 日志与普通日志的组合。
| 字段名称 | 字段值 |
| Date | 2022/06/06 09:13:38 |
| method | GET |
| status_code | 200 |
| url | https://www.zylker.com/logs/ingest |
| duration | 123456 |
JSON 对象
日志示例
{"timestamp":"2024-02-12 12:12:12","name":"Request Count of Sample App","widgetId":12,"description":"Event description","params":{"selected":212,"period":0},"version":"0.1"}
日志模式
json $widgetId:number$ $name$ $description$ $params:json-object$ $version$ $timestamp:date:yyyy-MM-dd HH:mm:ss$
JSON 数组
日志示例
{"routePlannerRouteId":"10010202","routeId":"10010202","routeDate":"2022-12-09T00:00:00","regionId":"548","oprCode":"initialETA","stopdetails":[{"attributes":"test1","locationKey":"53w4","routePlannerStopId":"257288","stopETA":"2022-12-10T15:27:09-05:00"},{"attributes":"test2","locationKey":"257288","routePlannerStopId":"257288","stopETA":"2022-12-09T13:26:58-05:00"},{"attributes":"test3","locationKey":"442433","routePlannerStopId":"442433","stopETA":"2022-12-10T15:27:09-05:00"}]}
日志模式
json $routePlannerRouteId$ $routeDate:date:yyyy-MM-dd'T'HH:mm:ss$ $routeId$ $regionId$ $oprCode$ $stopdetails:json-array:($locationKey$ $attributes$ $routePlannerStopId$ $stopETA$)$
字段名中使用空格
日志示例
{"Machine Time":"2019-01-01T09:27:11.620Z","keyid":"661dc0ae-404b-4f0d-9579-ceca6e20f22c","Service Name":"DEV-Station","Service Value":100,"Stack":"dev"}
日志模式
json $Machine Time as MachineTime:date:yyyy-MM-dd'T'HH:mm:ss.SSS'Z'$ $Service Value as ServiceValue:number$ $keyid$ $Service Name as ServiceName$ $Stack$
