Grok模式不返回结果

Question

我对麋鹿非常新，我一直坚持提取字段。below是示例数据

Dec 9 06:36:01 s-login-01 CRON[2436102]: pam_unix(cron:session): session closed for user mXXt

Dec 9 06:34:07 s-login-01 sshd[2424671]: Disconnected from user sw 10.xx.1x.xx port 4000

Dec 9 06:34:05 s-login-01 systemd-logind[2405]: Session 20923 logged out. Waiting for processes to exit.

，我有上述示例数据，我想知道如何为此编写.conf文件。我尝试使用以下.conf，但没有提取字段。

input {
file {
path => "/../syslog.log"
type => "syslog"
start_position => beginning
sincedb_path => "/dev/null"
}
}
filter {
grok {

    match => { "message" => "%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{NOTSPACE:HOST}%{SPACE}%{NOTSPACE:PROCESS}\[%{NUMBER:PID}\]\:%{GREEDYDATA:activity}" }
    match => { "message" => "%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{NOTSPACE:HOST}%{SPACE}%{NOTSPACE:PROCESS}\[%{NUMBER:PID}\]\:%{GREEDYDATA:activity}.?*%{WORD:User}" }
    match => { "message" => "%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{NOTSPACE:HOST}%{SPACE}%{NOTSPACE:PROCESS}\[%{NUMBER:PID}\]\:%{GREEDYDATA:activity}.?*%{WORD:User}.?*%{IP:IP}.?*%{NUMBER:Port}" }
    match => { "message" => "%{SYSLOGTIMESTAMP:timestamp}%{SPACE}%{NOTSPACE:HOST}%{SPACE}%{NOTSPACE:PROCESS}\[%{NUMBER:PID}\]\:%{GREEDYDATA:activity}.?*%{NUMBER:Session_ID}" }
}
}
output {
Elasticsearch {
hosts => ["localhost:9200"]
index => "sample_"
}
}

Answer 1

这是满足您提供的所有示例数据的单个grok模式：

%{SYSLOGTIMESTAMP:TIMESTAMP} %{DATA:HOST} %{DATA:PROCESS}\[%{BASE10NUM:PID}\]: %{GREEDYDATA:MSG}

我使用 grok debugger Grok模式。

这是输出：

---

在下面找到单个样本数据的Grok模式：

DEC 9 06:34:07 S-LOGIN-01 SSHD [2424671]：与用户SW 10.xx.1x.xx端口断开连接4000

%{SYSLOGTIMESTAMP:TIMESTAMP} %{DATA:HOST} %{DATA:PROCESS}\[%{BASE10NUM:PID}\]: %{DATA:ACTIVITY} %{DATA:msg} user %{DATA:USER} %{IP:IPADDRESS} %{DATA:msg} %{BASE10NUM:PORT}

12月9日06:36:01 S-Login-01 Cron [2436102]：PAM_UNIX（cron：session）：会话为USER MXXT

%{SYSLOGTIMESTAMP:TIMESTAMP} %{DATA:HOST} %{DATA:PROCESS}\[%{BASE10NUM:PID}\]: %{GREEDYDATA:ACTIVITY} user %{WORD:USER}

12月9日06:34： 05 S-Login-01 SystemD-Logind [2405]：Session 20923登录。等待流程退出。

%{SYSLOGTIMESTAMP:TIMESTAMP} %{DATA:HOST} %{DATA:PROCESS}\[%{BASE10NUM:PID}\]: Session %{BASE10NUM:SESSION_ID} %{GREEDYDATA:ACTIVITY}

Answer 2

你必须设置这样的我，我有匹配的模式你有错误

input {
        file {

        path => "/root/mult.log"
        start_position => "beginning"
        sincedb_path => "/dev/null"
        codec => multiline{

                 pattern => "^ -%{SPACE}%{TIMESTAMP_ISO8601}"
                 negate => true
                 what => "previous"
        }
}
 }
filter {
    grok {
     match => [
       "message", "(?m)^ -%{SPACE}%{TIMESTAMP_ISO8601:time} \[%{WORD:main}\] %{LOGLEVEL:loglevel}%{SPACE}\(%{JAVACLASS:class}\) %{DATA:mydata}\n(\t)?%{GREEDYDATA:stack}",
       "message", "^ -%{SPACE}%{TIMESTAMP_ISO8601:time} \[%{WORD:main}\] %{LOGLEVEL:loglevel}%{SPACE}\(%{JAVACLASS:class}\) %{GREEDYDATA:mydata}" ]
        break_on_match => false
 }
    date {
    match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
 }
}

output {
  stdout { codec => rubydebug}
elasticsearch {
    host => "localhost"
  }
}