[英]Logstash - grok use a field other than message
I am receiving Log4j generated log files from remote servers using Logstash forwarder. 我正在使用Logstash转发器从远程服务器接收Log4j生成的日志文件。 The log event has fields including a field named "file" in the format /tomcat/logs/app.log, /tomcat/logs/app.log.1, etc. Of course file path /tomcat/logs is on the remote machine and I would like Logstash to create files on the local file system using only the file name and not use the remote file path.
日志事件中的字段包括格式为/tomcat/logs/app.log、/tomcat/logs/app.log.1等的名为“文件”的字段。当然,文件路径/ tomcat / logs在远程计算机上我希望Logstash仅使用文件名而不使用远程文件路径在本地文件系统上创建文件。
Locally, I would like to create a file based on file name app.log, app.log.1, etc. How can one accomplish this? 在本地,我想基于文件名app.log,app.log.1等创建一个文件。如何实现此目的?
I am unable to use grok since it appears to work only with "message" field and not others. 我无法使用grok,因为它似乎仅适用于“消息”字段,而不适用于其他字段。
Example Log Event: 示例日志事件:
{"message":["11 Sep 2014 16:29:04,934 INFO LOG MESSAGE DETAILS HERE "],"@version":"1","@timestamp":"2014-09-15T05:44:43.472Z","file":["/tomcat/logs/app.log.1"],"host":"aus-002157","offset":"3116","type":"app.log"} {“ message”:[“ 2014年9月11日16:29:04,934此处的信息日志消息详细信息”],“ @ version”:“ 1”,“ @ timestamp”:“ 2014-09-15T05:44:43.472Z”, “文件”:[ “/ Tomcat的/日志/ app.log.1”], “宿主”: “AUS-002157”, “偏移量”: “3116”, “类型”: “app.log”}
Logstash configuration - what do I use to write the filter section? Logstash配置-如何编写过滤器部分?
input {
lumberjack {
port => 48080
ssl_certificate => "/tools/LogStash/logstash-1.4.2/ssl/logstash.crt"
ssl_key => "/tools/LogStash/logstash-1.4.2/ssl/logstash.key"
}
}
filter{
}
output {
file{
#message_format => "%{message}"
flush_interval => 0
path => "/tmp/%{host}.%{type}.%{filename}"
max_size => "4M"
}
}
Figured out the pattern to be as follows: 得出的模式如下:
grok{
match => [ "file", "^(/.*/)(?<filename>(.*))$" ]
}
Thanks for the help! 谢谢您的帮助!
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.