Logstash 解析Kong字符串删除json嵌套字段

1、场景

Logstash 收集Kong的日志，有字段类型不一致导致报错，
object mapping for [request.querystring.login] tried to parse field [login] as object, but found a concrete value

2、配置Logstash文件

[root@gtcq-gt-monitor-prometheus-01 conf.d]# more  getway_kong_log.conf 
input{
    kafka{
           bootstrap_servers => "10.152:9092"
           group_id => "getway_kong_logs"
           topics => "getway_kong_logs"
           consumer_threads => 3
           decorate_events => true
           auto_offset_reset => "earliest"
           type => "getway_kong_logs"           
    }
}
filter {
    if [type] == "getway_kong_logs" {
     mutate { 
                add_field => { "types" => "%{type}"}
             }
     json {
                source => "message"
          }

     json {
                source => "message"
          } 
     mutate {
                remove_field => ["message","route","querystring","[request][querystring]"]
          }
    }
}
output {
      if [types] == "getway_kong_logs" {
      
         elasticsearch {
            hosts => ["10.152:60993","10.152:60993","10.152:60993"]
            index => "kong_logs_%{+YYYY_MM_dd}"
           }
      }


#     stdout {
#                codec => "rubydebug"
#        }
}
[root@gtcq-gt-monitor-prometheus-01 conf.d]# 

注意核心是：remove_field => ["message","route","querystring","[request][querystring]"]