日志格式:
[INFO] 100092 2017-09-12 00:00:02 547f42d3-3d3c-9e83-e6c4-fab2566c663e front_req: {\"pAppCode\":\"100092\",\"pCinemaID\":\"18\",\"pScreenID\":\"98\",\"pVerifyInfo\":\"e5c919d906180f7e81152f07fe562bdf\"}
grok:\[%{LOGLEVEL:loglevel}\] %{NUMBER:appCode} %{TIMESTAMP_ISO8601:time} %{UUID:uuid} (%{WORD: request})?(\:)?%{GREEDYDATA:Message}
配置文件中如下:
input {
file {
path => "/test.log"
type => "web_log"
start_position => "beginning"
codec => multiline {
pattern => "^\["
negate => true
what => "next"
}
sincedb_path => "/dev/null"
}
}
filter {
grok {
patterns_dir => "../patterns/web_log"
match => { "message" => "%{WEBLOG}" }
}
}
patterns中配置如下
WEBLOG \[%{LOGLEVEL:loglevel}\] %{NUMBER:appCode} %{TIMESTAMP_ISO8601:time} %{UUID:uuid} (%{WORD: request})? (\:)? %{GREEDYDATA:Message}
kibana结果如下:
"message": "[INFO] 100092 2017-09-12 00:00:02 547f42d3-3d3c-9e83-e6c4-fab2566c663e front_req: {\"pAppCode\":\"100092\",\"pCinemaID\":\"18\",\"pScreenID\":\"98\",\"pVerifyInfo\":\"e5c919d906180f7e81152f07fe562bdf\"}",
"type": "web_log",
"tags": [
"_grokparsefailure"
]
[INFO] 100092 2017-09-12 00:00:02 547f42d3-3d3c-9e83-e6c4-fab2566c663e front_req: {\"pAppCode\":\"100092\",\"pCinemaID\":\"18\",\"pScreenID\":\"98\",\"pVerifyInfo\":\"e5c919d906180f7e81152f07fe562bdf\"}
grok:\[%{LOGLEVEL:loglevel}\] %{NUMBER:appCode} %{TIMESTAMP_ISO8601:time} %{UUID:uuid} (%{WORD: request})?(\:)?%{GREEDYDATA:Message}
配置文件中如下:
input {
file {
path => "/test.log"
type => "web_log"
start_position => "beginning"
codec => multiline {
pattern => "^\["
negate => true
what => "next"
}
sincedb_path => "/dev/null"
}
}
filter {
grok {
patterns_dir => "../patterns/web_log"
match => { "message" => "%{WEBLOG}" }
}
}
patterns中配置如下
WEBLOG \[%{LOGLEVEL:loglevel}\] %{NUMBER:appCode} %{TIMESTAMP_ISO8601:time} %{UUID:uuid} (%{WORD: request})? (\:)? %{GREEDYDATA:Message}
kibana结果如下:
"message": "[INFO] 100092 2017-09-12 00:00:02 547f42d3-3d3c-9e83-e6c4-fab2566c663e front_req: {\"pAppCode\":\"100092\",\"pCinemaID\":\"18\",\"pScreenID\":\"98\",\"pVerifyInfo\":\"e5c919d906180f7e81152f07fe562bdf\"}",
"type": "web_log",
"tags": [
"_grokparsefailure"
]
0 个回复