![](/img/trans.png)
[英]Why is my grok filter not parsing my filebeats messages ? I cannot see the logstash parsed field in Kibana (ELK)
[英]Cannot handle multiline input from filebeats in logstash with grok
我是Logstash的新手,並且在來自文件拍的Logstash中有以下多行輸入:
"message":"[step info]\\nstep: 3\\ngrammar name: grammar1\\nnoInputTimeout: 6000\\nstep stream idle time: 14910\\nstep stream start time: 2017-12-01 17:06:10.024\\nrec start time: 2017-12-01 17:06:09.994\\nrec finish time: 2017-12-01 17:06:12.748\\nsystem prompt duration: 570\\nuser barged in: true\\nuser noInput time: 0\\nuser speech duration: 1190\\nspeech start trigger: 8265\\nspeech start on rec: 7945\\nspeech end trigger: 8415\\nspeech end on rec: 9135\\nrec completion cause: 000 success\\nrec completion type: SR\\nrec result: onetwothreefour\\nrec inputMode: speech\\nRTF: 0.47\\nrec process time: 557\\nrec latency: 61\\nrec post delay: 62"
我正在嘗試找到帶有grok的圖案,但沒有任何效果。 我也嘗試了split和mutate,但無法使其正常工作。
這只是您嘗試使用的指針,但是KV過濾器 (鍵值過濾器)可能會有所幫助。
查看您的示例,您可以執行以下操作。
kv {
source => "message"
field_split => "\n"
value_split => ":"
}
這將以您為例
"message":"[step info]\nstep: 3\ngrammar name: grammar1\nnoInputTimeout: 6000\nstep stream idle time: 14910\nstep stream start time: 2017-12-01 17:06:10.024\nrec start time: 2017-12-01 17:06:09.994\nrec finish time: 2017-12-01 17:06:12.748\nsystem prompt duration: 570\nuser barged in: true\nuser noInput time: 0\nuser speech duration: 1190\nspeech start trigger: 8265\nspeech start on rec: 7945\nspeech end trigger: 8415\nspeech end on rec: 9135\nrec completion cause: 000 success\nrec completion type: SR\nrec result: onetwothreefour\nrec inputMode: speech\nRTF: 0.47\nrec process time: 557\nrec latency: 61\nrec post delay: 62"
然后在\\ n char上分割,然后從您擁有的示例中創建鍵值對,左側將是字段名稱,右側將是值。
step: 3
grammar name: grammar1
noInputTimeout: 6000
step stream idle time: 14910
step stream start time: 2017-12-01 17:06:10.024
rec start time: 2017-12-01 17:06:09.994
rec finish time: 2017-12-01 17:06:12.748
如果您需要拆分[step info],則需要提供更多示例,但我將使用greedydata基本上將您的內容拆分為2個字段,其中1個為[step info],1個為[step lines]。並將分隔線作為上方KV濾波器的源字段。
希望這能為您指明正確的方向。
E.
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.