[英]logstash - split a message by newlines
日志存儲
嘗試通過換行符( "\n"
)拆分消息,但到目前為止沒有成功。 我只需要檢索最后一行。
日志存儲代碼:
mutate{
split => ["traceback", "\n"]
add_field => {"traceback_last_line" => "%{[traceback][-1]}"}
}
輸入:
[traceback] =
"File "<doctest...>", line 10, in <module>
lumberjack()
File "<doctest...>", line 4, in lumberjack
bright_side_of_death()
IndexError: tuple index out of range"
我用gsub
替換'\n'
然后,通常的 mutate.split 序列
mutate {
copy => { "traceback" => "traceback_tmp" }
}
mutate {
gsub => ["traceback_tmp", "\n", "::"]
}
mutate {
split => {"traceback_tmp" => "::"}
add_field => ["traceback_summary", "%{[traceback_tmp][-1]}"]
remove_field => ["traceback_tmp"]
}
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.