logstash - 用换行符分割消息

Question

日志存储

尝试通过换行符（ "\n" ）拆分消息，但到目前为止没有成功。 我只需要检索最后一行。

日志存储代码：

mutate{
    split => ["traceback", "\n"]
    add_field => {"traceback_last_line" => "%{[traceback][-1]}"}
}

输入：

[traceback] = 
  "File "<doctest...>", line 10, in <module>
    lumberjack()
  File "<doctest...>", line 4, in lumberjack
    bright_side_of_death()
IndexError: tuple index out of range"

Answer 1

我用gsub替换'\n'然后，通常的 mutate.split 序列

    mutate {
       copy => { "traceback" => "traceback_tmp" }
    }
    mutate {
       gsub => ["traceback_tmp", "\n", "::"]
    }
    mutate {
       split => {"traceback_tmp" => "::"}
       add_field => ["traceback_summary", "%{[traceback_tmp][-1]}"]
       remove_field => ["traceback_tmp"]
    }