ruby中如何操作json数据结构

来源：12-9 filter 插件之geoip和ruby 讲解

qq_无妄_3

2019-03-13

这是bx2.txt中的数据

[{"COLLECTTIME":"2019-03-12 11:09:05","CompKey":"134.108.14.44|katest_BILLING_MQ_billing_broker_002_%RETRY%acctQueryBillMqConsumerGroup_acctQueryBillMqConsumerGroup_10911","HOSTIP":"134.108.14.44","ID":"189551268","METRICCODE":"30202624270009","METRICTYPE":"2","METRICVALUE":"0","SEQID":""},{"COLLECTTIME":"2019-03-12 11:09:05","CompKey":"134.108.14.43|katest_BILLING_MQ_billing_broker_001_%RETRY%acctQueryBillMqConsumerGroup_acctQueryBillMqConsumerGroup_10911","HOSTIP":"134.108.14.43","ID":"189551274","METRICCODE":"30202624270009","METRICTYPE":"2","METRICVALUE":"0","SEQID":""}]

这是我的conf

input {
 file{
	path => "/app/app/logstash-6.2.4/conf/bx2.txt"
	start_position => beginning
	type => "test1"
 } 
}



filter{

	json{
		skip_on_invalid_json => true
		source => "message"
		target => "message1"
	}
	
	ruby{
		code => 'message1 = event.get("message1")
				temp1=Hash["30202623260001" =>	"170201","30202623260002" => "170201","30202623260003" => "170201","30202623260004" => "170201","30202623260005" => "170201","30202623260006" =>	"170202","30202624260001" => "170201","30202624260002" => "170202","30202624260003" =>	"170202","30202624260004" => "170202","30202624260005" => "170202","30202624260006" =>	"170202","30202624260007" => "170202","30202624260008" => "170202","30202624260009" =>	"170203","30202624260010" => "170203","30202624260011" => "170201","30202624260012" => "170201"]
				length = message1.length-1
				message2 = Array.new
				for i in 0..length do
					temp2 = message1[i]
					temp4 = temp2["METRICCODE"]
					temp3 = temp1[temp4]
					temp2["CONTYPE"]= temp3
					message2[i] = temp2
				end
				event.set("doc2",message2)'
	}
	

	mutate {
		remove_field => [ "message","message1" ]
	}

}
output{
stdout { codec => rubydebug }

#	if [tags] {
#		
#	}else{
#		stdout { codec => rubydebug }
#		file {
#			path => "/app/app/logstash-6.2.4/test.txt"
#			codec => line { format => "%{message1}"}
#		}
#	}
}

这是结果；没出来为nil。。。。
图片描述
我对ruby也不了解
搞了两天了；没头绪；请教老师这是哪里的问题。