[英]How to write custom grok for logstash
I'm trying to test the some custom log filter for logstash but somehow i'm not able to get it, I googled and looked over many examples but I am not able to create a one I want. 我正在尝试测试一些自定义日志过滤器的logstash,但是以某种方式我无法获取它,我用google搜索并查看了许多示例,但无法创建我想要的示例。
Below is my log patterns: 以下是我的日志模式:
testhost-in2,19/01/11,06:34,04-mins,arnav,arnav 2427 0.1 0.0 58980 580 ? S 06:30 0:00 rm -rf /test/ehf/users/arnav-090119-184844,/dv/ehf/users/arnav-090119-
testhost-in2,19/01/11,06:40,09-mins,arnav,arnav 2427 0.1 0.0 58980 580 ? S 06:30 0:00 rm -rf /dv/ehf/users/arnav-090119-184844,/dv/ehf/users/arnav-090119-\
testhost-in2,19/01/11,06:45,14-mins,arnav,arnav 2427 0.1 0.0 58980 580 ? S 06:30 0:01 rm -rf /dv/ehf/users/arnav-090119-184844,/dv/ehf/users/arnav-090119-\
below is what I trying to create but does not works. 以下是我尝试创建的但不起作用的内容。
HOSTNAME:hostname DATE:date HOURS_Time:hour_min USERNAME: username USERNAME:username NUMBER:pid COMMAND
any help Will be much appreciated. 任何帮助都感激不尽。
Tried: 尝试过:
%{HOSTANME}%{TIMESTAMP_ISO8601:RecordedDateTimeStamp} %{USERNAME:User} %{USERNAME:User} %{NUMBER:PID} %{FLOAT:mem} %{FLOAT:res} %{NUMBER:PID} %{NUMBER:PID} %{GREEDYDATA}
AND 和
%{HOSTANME}%{TIMESTAMP_ISO8601}%{HOUR}%{MINUTE}%{NUMBER}%{WORD}%{USER}%{USER}%{NUMBER: pid}%{NUMBER:float}%{NUMBER:float}%{NUMBER}%{NUMBER}%{GREEDYDATA}
Great start! 伟大的开始! Here is a grok pattern that should work better: 这是一个应该更好用的grok模式:
%{HOSTNAME:hostname},%{DATE:date},%{HOUR:hour1}:%{MINUTE:minute1},%{NUMBER}-%{WORD},%{USER:user},%{USER:user2} %{NUMBER:pid} %{NUMBER:float} %{NUMBER:float} %{NUMBER:number1} %{NUMBER:number2} %{DATA} %{HOUR:hour2}:%{MINUTE:minute2} %{HOUR:hour3}:%{MINUTE:minute3} %{GREEDYDATA:command},%{PATH:path}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.