[英]Logstash grok pattern to filter a pretty long log line, add ignore between
This is a log line 这是一条日志行
2015-10-05 12:04:19.199 INFO 4808 --- [metrics-logger-reporter-2-thread-1] com.example.metrics : type=TIMER, name=demo.ws.rest.controllers.ItemController.getAllItems, count=0, min=0.0, max=0.0, mean=0.0, stddev=0.0, median=0.0, p75=0.0, p95=0.0, p98=0.0, p99=0.0, p999=0.0, mean_rate=0.0, m1=0.0, m5=0.0, m15=0.0, rate_unit=events/second, duration_unit=milliseconds
I tried to learn grok and this is what i have so far 我试图学习希腊语,这就是我到目前为止所拥有的
"message" => "%{TIMESTAMP_ISO8601:time}%{SPACE}%{WORD}%{SPACE}%{NUMBER}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{NOTSPACE}%{SPACE}%{WORD}%{NOTSPACE}%{WORD:metrictype}%{NOTSPACE}%{SPACE}%{WORD:vardspirms}%{DATA:pirms}%{JAVAFILE:javafilename}%{NOTSPACE:peec}%{SPACE}%{WORD}%{NOTSPACE}%{NUMBER:count}%{GREEDYDATA:debuginfo}"
And it looks so long, inefficient and bad practise. 它看起来很长,效率低下,而且不好用。 I would like to know, how can I add ignore inside grok.
我想知道,如何在grok中添加忽略。 so i can ignore everything between INFO and type.
所以我可以忽略INFO和类型之间的所有内容。 Sorry for my english, Im not a native speaker.
对不起,我的英语不是我的母语。
I found a pretty handy solution. 我找到了一个非常方便的解决方案。
kv {
source => "debuginfo" # new field generated by grok before
field_split => ", " # split fields by semicolon
}
Seems to split everything in debuginfo pretty good. 似乎可以在debuginfo中拆分所有内容。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.