我有一个获取互联网历史的powershell脚本,我想将数据发送到日志存储。该函数返回一个PSObjects数组,通过管道将其传递给该函数:
function ConvertTo-logstash
{
Begin {
$result = ""
}
Process {
$result += $_ | ConvertTo-Json -Compress -Depth 1
$result += "`n"
}
end {
$result.replace("\","\\")
}
}
它返回如下所示的数据:
{"Browser":"IE10/11","Category":"internethistory","Function":"inethistory","HostIP":"172.16.100.93","HostName":"wkst-7-2","LastVisitTime":"2016-08-01T16:27:13","Title":"","URL":"res://C:\\Windows\\system32\\mmcndmgr.dll/views.htm","User":"scrub","VisitCount":2}
{"Browser":"IE10/11","Category":"internethistory","Function":"inethistory","HostIP":"172.16.100.93","HostName":"wkst-7-2","LastVisitTime":"2016-08-02T14:33:26","Title":"","URL":"file:///C:/Users/scrub/Desktop/privEsc.ps1","User":"scrub","VisitCount":1}
{"Browser":"IE10/11","Category":"internethistory","Function":"inethistory","HostIP":"172.16.100.93","HostName":"wkst-7-2","LastVisitTime":"2016-08-15T10:24:38","Title":"","URL":"file:///C:/Users/scrub/Documents/template.pdf","User":"scrub","VisitCount":22}
...
我将此信息写入一个文件,然后通过套接字连接将此数据发送到logstash。问题是logstash阻塞了这个数据,说明json无效,索引字段“Category”必须是小写的,事实就是这样。当我在记事本中打开文件,在第一个条目后放一个换行符,然后发送它时,logstash处理得很好。我试着换衣服
$result += "`n"
到
$result += "`r`n"
因为这就是将换行符放在记事本中所做的改变,但没有运气。为什么logstash似乎无缘无故地对这些数据感到窒息?
编辑:添加换行符无关紧要。只需在记事本中打开并保存而不修改它,似乎就能修复错误。当前正在检查文件的二进制文件以找出差异。