input {
stdin {
codec => "json"
}
}
filter {
mutate {
add_field => {
"[query][bool][must][term][user_id]" => "%{user_id}"
"[query][bool][must][term][focus_user_id]" => "%{focus_user_id}"
}
}
}
output {
stdout {
codec => "json_lines"
}
}
想得到的目标格式是:
{
"query": {
"bool": {
"must": [{
"term": {
"user_id": 3227220
}
}, {
"term": {
"focus_user_id": 4126621
}
}
]
}
}
}实际得到的是：{
"query": {
"bool": {
"must": {
"term": {
"user_id": "3227220",
"focus_user_id": "4126621"
}
}
}
}
}
请问如何修改
0 个回复