[英]grok filter for logstash
My log file has lines of the form: 我的日志文件具有以下形式的行:
10/13 14:05:18.192 [modulename]: [pid]: (debug level string): message string XYZ:<xyz value>
where 哪里
modulename
is a string modulename
是一个字符串 pid
is an integer number pid
是一个整数 debug level string
is a string like "debug" or "info" or "error" debug level string
是类似于“调试”或“信息”或“错误”的字符串 message string
is a string message string
是一个字符串 xyz value
is an integer number xyz value
是一个整数 example: 例:
10/13 14:05:18.192 [MyModule]: [12345]: (debug): This is my message. XYZ: 987
I searched around and tried a few things, but am getting _grokparsefailure
. 我四处搜寻并尝试了一些操作,但正在获取_grokparsefailure
。 Can someone help show me what filter I can use in logstash to parse these logs? 有人可以帮我告诉我可以在logstash中使用哪些过滤器来解析这些日志吗?
First of all {GREEDYDATA}
means until the end of a logging event. 首先{GREEDYDATA}
表示直到日志记录事件结束。 So, all the text that resides after dbg_lvl
will be assigned to {GREEDYDATA}
因此, dbg_lvl
之后的所有文本都将分配给{GREEDYDATA}
Here, try the following code. 在这里,尝试以下代码。 The problem with your code filter was it was not able to parse anything after msg
. 您的代码过滤器存在的问题是msg
之后无法解析任何内容。 Hope this helps. 希望这可以帮助。
(?<date>\\d\\d/\\d\\d) %{TIME:time} \\[%{WORD:module}\\]: \\[%{WORD:pid}\\]: \\(%{WORD:log_level}\\): %{CISCO_REASON}. %{WORD}: %{BASE10NUM:xyz_number}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.