用logstash处理数据,源数据如下:
 
实际上想要的效果是一行一个message,请问该如何处理
														Vendor daemon status (on license-sever4):
   snpslmd: UP v11.16.4
Feature usage info:
Users of SSS:  (Total of 1 license issued;  Total of 0 licenses in use)
Users of ACS:  (Total of 8 licenses issued;  Total of 0 licenses in use)
Users of Advanced_CDC:  (Total of 2 licenses issued;  Total of 0 licenses in use)
Users of BOA-BRT:  (Total of 8 licenses issued;  Total of 0 licenses in use)
Users of BasePolicySO:  (Total of 1 license issued;  Total of 0 licenses in use)
Users of CTV-Interface:  (Total of 1 license issued;  Total of 0 licenses in use)
Users of DC-Expert:  (Total of 8 licenses issued;  Total of 0 licenses in use)match => {
      "message" => [
        "(?m)(?<feat_name>%{LICNAME}):  \(Total of %{NUMBER:[feature][total]} licenses? issued;  Total of %{NUMBER:[feature][used]} licenses? in use\)"
      ]
    }
实际上想要的效果是一行一个message,请问该如何处理


 
	
0 个回复