用logstash处理数据,源数据如下:
实际上想要的效果是一行一个message,请问该如何处理
Vendor daemon status (on license-sever4):
snpslmd: UP v11.16.4
Feature usage info:
Users of SSS: (Total of 1 license issued; Total of 0 licenses in use)
Users of ACS: (Total of 8 licenses issued; Total of 0 licenses in use)
Users of Advanced_CDC: (Total of 2 licenses issued; Total of 0 licenses in use)
Users of BOA-BRT: (Total of 8 licenses issued; Total of 0 licenses in use)
Users of BasePolicySO: (Total of 1 license issued; Total of 0 licenses in use)
Users of CTV-Interface: (Total of 1 license issued; Total of 0 licenses in use)
Users of DC-Expert: (Total of 8 licenses issued; Total of 0 licenses in use)
logstash处理如下:match => {
"message" => [
"(?m)(?<feat_name>%{LICNAME}): \(Total of %{NUMBER:[feature][total]} licenses? issued; Total of %{NUMBER:[feature][used]} licenses? in use\)"
]
}
但是处理过后在kibana上显示,会将所有的行归到一个message里去,如下图:实际上想要的效果是一行一个message,请问该如何处理
0 个回复