如何用logstash修改此输入？

Question

I'm trying to grok some lines with logstash, so first I created two patterns witch look like this :

AZ_LIST [1-9a-zA-Z,]+
AZ_STRING [a-zA-Z._-]+

and then I configured logstash to grok this input :

security=0 system=23 CPU=this.adresse_false Pvm=0,0,0,0,0,0,0,0 Vlan2=AZERT,566,2184,798,3312  

My filter is :

filter {
    grok {
        patterns_dir => "/patterns"

        match => [
            "message" , "security=%{NUMBER:security} system=%{NUMBER:system} CPU=%{AZ_STRING:CPU} Pvm=%{AZ_LIST:Pvm} Vlan2=%{AZ_LIST:Vlan2}"
         ]
        tag_on_failure => [ "failure_grok_exemple" ]
        break_on_match => false  
    }
}

But these doesn't work

Answer 1

There is an error in your pattern. Your AZ_LIST do not include 0 , but your logs have 0 EX: Pvm=0,0,0,0,0,0,0,0

This is my config, I can parse your log successfully.

filter {
        grok {
                patterns_dir => "./patterns/"
                match => [
                "message" , "security=%{NUMBER:security} system=%{NUMBER:system} CPU=%{AZ_STRING:CPU} Pvm=%{AZ_LIST:Pvm} Vlan2=%{AZ_LIST:Vlan2}"
                ]
        }
}

Pattern:

AZ_LIST [0-9a-zA-Z,]+
AZ_STRING [a-zA-Z._-]+