[英]Grok parse failure - while filtering error logs
嗨,我收到以下错误:
"tags" => [
[0] "beats_input_codec_plain_applied",
[1] "_grokparsefailure"
]
我的 logstash-sample.conf 如下
input {
beats {
port => "5044"
}
}
filter {
grok {
match => ["message","HTTPD20_ERRORLOG \[%{HTTPDERROR_DATE:timestamp}\] \[%{LOGLEVEL:loglevel}\] (?:\[client %{IPORHOST:clientip}\] )$
}
}
output {
stdout { codec => rubydebug }
}
任何人都可以帮助我我在这里做什么错了吗? 同样在模式 {LOGLEVEL:loglevel}] (?:[client %{IPORHOST:clientip} 我需要指定 loglevel 和 clientip 吗?
我的日志样本:
2020-10-09 14:24:33,489 [Thread1] INFO ReceiverLogging- Connecting
2020-10-09 14:24:34,166 [Thread1] INFO ReceiverLogging- Connected...
2020-10-09 14:24:34,166 [Thread1] INFO ReceiverLogging- Getting folder...
2020-10-09 14:24:34,167 [Thread1] INFO ReceiverLogging- Got folder
2020-10-09 14:24:34,167 [Thread1] INFO ReceiverLogging- Opening folder
2020-10-09 14:24:34,237 [Thread1] INFO ReceiverLogging- getting folder
2020-10-09 14:24:34,247 [Thread-6] ERROR CheckLog Error While Connecting to Websocket
javax.websocket.DeploymentException: The HTTP request to initiate the WebSocket connection failed
at org.apache.tomcat.websocket.WsWebSocketContainer.connectToServer(WsWebSocketContainer.java:392)
at org.apache.tomcat.websocket.WsWebSocketContainer.connectToServer(WsWebSocketContainer.java:150)
at global.services.WebSocketClient.<init>(WebSocketClient.java:33)
at global.services.WebSocketClient.getInstance(WebSocketClient.java:51)
at global.services.SchedulerThread.run(SchedulerThread.java:63)
Caused by: java.util.concurrent.TimeoutException
at sun.nio.ch.PendingFuture.get(PendingFuture.java:197)
at org.apache.tomcat.websocket.WsWebSocketContainer.processResponse(WsWebSocketContainer.java:674)
at org.apache.tomcat.websocket.WsWebSocketContainer.connectToServer(WsWebSocketContainer.java:340)
... 4 more
2020-10-09 14:24:34,248 [Thread-6] ERROR Exception- Error While Connecting to Websocket
请帮忙
首先,我建议了解 GROK 的一些基础知识及其工作原理。 在答案末尾添加一些有用的资源。
日志中的当前模式类似于 TIMESTAMP CLASSNAME LOGLEVEL LOGMESSAGE
对于下面问题中的日志示例是一个示例管道,但不确定是否需要多行来捕获堆栈跟踪。 在这种情况下,下面可以扩展。
filter {
grok{
match => { "message" => "%{TIMESTAMP_ISO8601:timeStamp}%{SPACE}\[%{DATA:className}\]%{SPACE}%{LOGLEVEL:logLevel}%{SPACE}%{GREEDYDATA:message}"}
overwrite => [ "message" ]
}
date {
match => ["timeStamp","yyyy-MM-dd HH:mm:ss,SSS"]
timezone => "Europe/London"
target => "@timestamp"
remove_field => ["timeStamp"]
}
}
输出事件看起来像
{
"logLevel" => "INFO",
"@version" => "1",
"path" => "/usr/share/logstash/stack/data/data.log",
"className" => "Classname",
"host" => "95b3783b146a",
"@timestamp" => 2020-10-09T13:24:35.004Z,
"message" => "LOGG- Sending message : Test"
}
{
"logLevel" => "ERROR",
"@version" => "1",
"path" => "/usr/share/logstash/stack/data/data.log",
"className" => "Classname",
"host" => "95b3783b146a",
"@timestamp" => 2020-10-09T13:24:35.004Z,
"message" => "InternetApp- in details."
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.