如何使這個正則表達式起作用？

Question

我正在創建自己的 ELK 儀表板來監控我的財務狀況。

今年我完全被淘汰了，這是很多事情的結合，但很可能只是財政責任不佳。

反正;

我是正則表達式新手，對此我很難過。

有沒有辦法快速匹配帶有許多尾隨和前導空格的字符串？

這是我的角色：

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Account:                                                                                                                                                                                                            ************0000                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         Purchase Amount:                                                                                                                                                                                                            $10.00                                                                                                                                                                                                                                                                                                                                                                                                       Transaction Date:                                                                                                                                                                                                            November 10, 2022                                                                                                                                                                                                                                                                                                                                                                                                       Transaction Description:                                                                                                                                                                                                            UBER *TRIP HELP.UBER.C                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

這是我在 regexr.com 中嘗試的內容

(?<account>(?<=Account:)(.*)(?=\s*Pur))我的結果包含很多空格：

                                                                                                                                                                                                            ************0000                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         

我想將所有交易 $KEY:$VALUE 對作為命名捕獲，以便 grok 過濾我的銀行交易。

結果應該是：

(?<account>($StackOverFlowSuperChargedRegex)

**************0000

這是我的 regxr.com 工作區鏈接： regexr.com/736tg

編輯：我將此 grok 模式應用於彈性搜索攝取管道，但我不反對將其用於 logstash 攝取。

編輯 2：@Paulo

這是應用 trim 和 gsub 后的內容字段（未應用解剖處理器）

"content": "View Online Hello, As requested, we’re letting you know that a purchase of $10.00 was made on your RBC Royal Bank credit card account ************0000 on November 12, 2022 towards UBER *TRIP HELP.UBER.C. If you don’t recognize this transaction, please call us at 1‑800‑769‑2512 (available 24/7) and we’ll be happy to help. Account: ************0000 Purchase Amount: $10.00 Transaction Date: November 12, 2022 Transaction Description: UBER *TRIP HELP.UBER.C Thank you!     - Privacy & Security | Legal -   RBC Royal Bank | Royal Bank of Canada RBC WaterPark Place, 88 Queens Quay West, 12th Floor, Toronto, ON, M5J 0B8, Canada www.rbcroyalbank.com. ®/TM Trademark(s) of Royal Bank of Canada. RBC and Royal Bank are registered trademarks of Royal Bank of Canada. © Royal Bank of Canada 2022   -   Communicating Safely Online   Regular, unencrypted email is not secure. You should never include personal or confidential information in a regular email. Be careful when opening messages, links or attachments received through digital channels, including regular emails, text messages and social media messages. If you receive a message that appears to be from RBC that is suspicious please report it to us and then delete it. Do not provide personal information like passwords.   Need Help? To discuss your personal information with us safely, visit our customer service page. Please note this email was sent from an unmonitored inbox. Do not reply.   For current scam alerts and tips to protect yourself visit: RBC Cyber Security | Active Scam Alerts    "
        },
        "_ingest": {
          "timestamp": "2022-11-25T11:18:28.621402003Z"
        }

Answer 1

Tldr

不使用Grok ，但我覺得它可能有幫助

解決方案

POST /_ingest/pipeline/_simulate
{
  "pipeline": {
    "description": "_description",
    "processors": [
      {
        "trim": {
          "field": "message"
        }
      },
      {
        "gsub": {
          "field": "message",
          "pattern": """\s+""",
          "replacement": " "
        }
      },
      {
        "dissect": {
          "field": "message",
          "pattern": "Account: %{account} Purchase Amount: %{amount} Transaction Date: %{date} Transaction Description: %{description}"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": "                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Account:                                                                                                                                                                                                            ************0000                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         Purchase Amount:                                                                                                                                                                                                            $10.00                                                                                                                                                                                                                                                                                                                                                                                                       Transaction Date:                                                                                                                                                                                                            November 10, 2022                                                                                                                                                                                                                                                                                                                                                                                                       Transaction Description:                                                                                                                                                                                                            UBER *TRIP HELP.UBER.C                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               
"
      }
    }
  ]
}

Answer 2

通過@Paulo 修復並更新我的 grok 模式； 不是最有效/優雅的解決方案，但效果很好。

    PUT _ingest/pipeline/fscrawler
{
  "version": 1,
  "processors": [
    {
      "trim": {
        "field": "content",
        "ignore_missing": true
      }
    },
    {
      "gsub": {
        "field": "content",
        "pattern": "\\s+",
        "replacement": " "
      }
    },
    {
      "grok": {
        "field": "content",
        "patterns": [
          "(?<account>(?<=Account:\\s)(.*)(?=\\sPurchase))"
        ],
        "trace_match": true,
        "ignore_missing": true,
        "ignore_failure": true
      }
    },
    {
      "grok": {
        "field": "content",
        "patterns": [
          "(?<amount>(?<=Amount:\\s)(.*)(?=\\sTransaction\\sDate))"
        ],
        "trace_match": true,
        "ignore_missing": true,
        "ignore_failure": true
      }
    },
    {
      "grok": {
        "field": "content",
        "patterns": [
          "(?<transaction_date>(?<=Transaction\\sDate:\\s)(.*)(?=\\sTransaction\\sDescription))"
        ],
        "trace_match": true,
        "ignore_missing": true,
        "ignore_failure": true
      }
    },
    {
      "grok": {
        "field": "content",
        "patterns": [
          "(?<transaction_description>(?<=Transaction\\sDescription:\\s)(.*)(?=\\sThank))"
        ],
        "trace_match": true,
        "ignore_missing": true,
        "ignore_failure": true
      }
    }
  ]
}