[英]How do I match a newline in grok/logstash?
我有一台遠程機器,它結合了多行事件並通過伐木工人協議發送它們。
進來的東西看起來像這樣:
{
"message" => "2014-10-20T20:52:56.133+0000 host 2014-10-20 15:52:56,036 [ERROR ][app.logic ] Failed to turn message into JSON\nTraceback (most recent call last):\n File \"somefile.py", line 249, in _get_values\n return r.json()\n File \"/path/to/env/lib/python3.4/site-packages/requests/models.py\", line 793, in json\n return json.loads(self.text, **kwargs)\n File \"/usr/local/lib/python3.4/json/__init__.py\", line 318, in loads\n return _default_decoder.decode(s)\n File \"/usr/local/lib/python3.4/json/decoder.py\", line 343, in decode\n obj, end = self.raw_decode(s, idx=_w(s, 0).end())\n File \"/usr/local/lib/python3.4/json/decoder.py\", line 361, in raw_decode\n raise ValueError(errmsg(\"Expecting value\", s, err.value)) from None\nValueError: Expecting value: line 1 column 1 (char 0), Failed to turn message into JSON"
}
當我嘗試將消息與
grok {
match => [ "message", "%{TIMESTAMP_ISO8601:timestamp} \[%LOGLEVEL:loglevel}%{ SPACE}\]\[%{NOTSPACE:module}%{SPACE}\]%{GREEDYDATA:message}" ]
}
GREEDYDATA
並不像我希望的那樣貪婪。
然后我嘗試使用 gsub:
mutate {
gsub => ["message", "\n", "LINE_BREAK"]
}
# Grok goes here
mutate {
gsub => ["message", "LINE_BREAK", "\n"]
}
但那個沒有用,而不是
The Quick brown fox
jumps over the lazy
groks
我有
The Quick brown fox\njumps over the lazy\ngroks
所以...
我如何將換行符添加回我的數據,使GREEDYDATA
匹配我的換行符,或者以其他方式獲取我的消息的相關部分?
所有GREEDYDATA
都是.*
,但是.
不匹配換行符,所以你可以用(?<message>(.|\\r|\\n)*)
替換%{GREEDYDATA:message}
並讓它變得真正貪婪。
將正則表達式標志添加到開頭允許匹配換行符:
match => [ "message", "(?m)%{TIMESTA...
我使用 (?m) 和 [^\\n]+ 對 Vertica 日志的最后理解
match => ["message","(?m)%{TIMESTAMP_ISO8601:ClientTimestamp}%{SPACE}(%{DATA:Action}:)?(%{DATA:ThreadID} )?(\[%{DATA:Module}\] )?(\<%{DATA:Level}\> )?(\[%{DATA:SubAction}\] )?(@%{DATA:Nodename}:)?( (?<Session>(\{.*?\} )?.*?/.*?): )?(?<message>[^\n]+)((\n)?(\t)?(?<StackTrace>[^\n]+))?"]
感謝 asperla
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.