Vector：如何处理第三方日志中含连字符的键名？

当你用Vector处理第三方JSON日志时，碰到像labels.this-has-hypens这种带连字符的键，常规的点语法没法直接访问，下面是几种实用的解决方法：

1. 直接用方括号语法访问 #

Vector的Remap语言支持用[]来访问含特殊字符的字段，比如要提取或修改labels.this-has-hypens：

[sources.my_json_source]
type = "file"
path = "/var/log/third-party/*.json"
format = "json"

[transforms.handle_hyphen_key]
type = "remap"
inputs = ["my_json_source"]
source = '''
# 把带连字符字段的值赋值给新字段
.extracted_value = .labels["this-has-hypens"]
# 也可以直接修改原字段内容
.labels["this-has-hypens"] = upper(.labels["this-has-hypens"])
'''

2. 重命名带连字符的键 #

如果想把这类键改成更易处理的下划线格式，单字段可以用rename_fields插件，批量处理就用Remap遍历：

单字段重命名 #

[transforms.rename_single_key]
type = "rename_fields"
inputs = ["my_json_source"]
fields = { "labels.this-has-hypens" = "labels.this_has_hypens" }

批量处理子字段 #

如果labels下有多个带连字符的键，遍历转换更高效：

[transforms.batch_rename_hyphens]
type = "remap"
inputs = ["my_json_source"]
source = '''
for key, val in .labels {
    # 把连字符替换成下划线
    new_key = replace(key, "-", "_")
    .labels[new_key] = val
    # 可选：删除原来的带连字符键
    del(.labels[key])
}
'''

3. 过滤路由时使用带连字符的键 #

做过滤或路由规则时，同样用方括号语法引用字段：

[transforms.filter_by_hyphen_field]
type = "filter"
inputs = ["my_json_source"]
condition = '.labels["this-has-hypens"] == "this is a test"'

内容的提问来源于stack exchange，提问作者Danny Staple