[英]Pattern for logstash
I try to use logstach for visualisation logs from our website. 我尝试使用logstach获取来自我们网站的可视化日志。
Our conf 我们的会议
input {
file {
path => 'f:/tst/zp/*zp*.log'
type => 'app'
start_position =>'end'
}
}
filter {
multiline {
pattern => ???
what => 'previous'
negate => true
}
}
output {
stdout { codec => rubydebug }
elasticsearch { embedded => true }
}
Our log example (Enterprise library) 我们的日志示例(企业库)
----------------------------------------
16.08.2012 6:46:40 [1476] [Error] General
Message: Error
System.FormatException: Input string was not in a correct format.
at System.Number.StringToNumber(String str, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean parseDecimal)
at System.Number.ParseInt32(String s, NumberStyles style, NumberFormatInfo info)
at ZCommon.Model.Search.VacancySearchArgs.<MakeSql>b__d(String[] x) in d:\Builds\Sources\DM_Zarplata4.2_Retail3\DM_Zarplata\Zarplata4\releases\current\ZCommon4.4\Model\Search\VacancySearchArgs.cs:line 126
----------------------------------------
Can you help with pattern? 你能帮忙做图案吗? I use http://grokdebug.herokuapp.com/ for making pattern, but pattern isn't work.
我使用http://grokdebug.herokuapp.com/制作图案,但是图案不起作用。
Try this pattern 试试这个模式
filter {
multiline {
pattern => "^[0-9]{2}\.[0-9]{2}\.[0-9]{4}"
what => 'previous'
negate => true
}
}
It's works on me. 它对我有效。 The pattern is used to filter the date.
该模式用于过滤日期。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.