logstash-通过自定义grok模式解析可选日志

发布于 2025-02-07 12:15:08 字数 1028 浏览 2 评论 0原文

以下是我的日志模式

Sample 1 :
2022-06-14 02:03:22.051  INFO  [ServiceName,TraceId,SpanID] 109171 --- [Thread] ClassName : A=ValueA B=ValueB C=ValueC

Sample 2:
2022-06-14 02:03:22.051  INFO  [ServiceName,TraceId,SpanID] 109171 --- [Thread] ClassName : D=ValueD B=ValueB C=ValueC

Sample 3:
2022-06-14 02:03:22.051  INFO  [ServiceName,TraceId,SpanID] 109171 --- [Thread] ClassName : D=ValueD E=ValueE C=ValueC F=ValueF

Sample 4:
INFO  [ServiceName,TraceId,SpanID] 109171 --- [Thread] ClassName : Some Log Message

以下是我尝试了自定义模式的grok模式

： aa =。*a bb =。*b和类似的类似

，例如以下日志模式：

%{TIMESTAMP_ISO8601:timestamp}?%{SPACE}*%{LOGLEVEL:log-level}%{SPACE}*\[%{DATA:service},%{DATA:ZTraceId},%{DATA:ZSpanId}\]%{SPACE}*%{NUMBER:ProcessId}%{GREEDYDATA:message}%{A:Afield}

上面的日志在sample1中工作，而不是2,3＆amp; 4

％{timestamp_iso8601：timestamp}？ ----可选的方式

同时在所有样本中起作用， ％{a：afield}？未在样本1,2,3,4中工作。...在未识别的样本中，

任何人都可以为可选的自定义Grok模式提供解决方案

原文

Following is my log patterns

Sample 1 :
2022-06-14 02:03:22.051  INFO  [ServiceName,TraceId,SpanID] 109171 --- [Thread] ClassName : A=ValueA B=ValueB C=ValueC

Sample 2:
2022-06-14 02:03:22.051  INFO  [ServiceName,TraceId,SpanID] 109171 --- [Thread] ClassName : D=ValueD B=ValueB C=ValueC

Sample 3:
2022-06-14 02:03:22.051  INFO  [ServiceName,TraceId,SpanID] 109171 --- [Thread] ClassName : D=ValueD E=ValueE C=ValueC F=ValueF

Sample 4:
INFO  [ServiceName,TraceId,SpanID] 109171 --- [Thread] ClassName : Some Log Message

Following is the grok pattern I tried

Custom Patterns:
A A=.*A
B B=.*B and similar

For Example following log pattern :

%{TIMESTAMP_ISO8601:timestamp}?%{SPACE}*%{LOGLEVEL:log-level}%{SPACE}*\[%{DATA:service},%{DATA:ZTraceId},%{DATA:ZSpanId}\]%{SPACE}*%{NUMBER:ProcessId}%{GREEDYDATA:message}%{A:Afield}

Above log works in Sample1 but not 2,3 &4

%{TIMESTAMP_ISO8601:timestamp}? ---- Optional way works in all samples

At the same time,
%{A:Afield}? Doesnt work in Sample 1,2,3,4....In Sample Afield is not identified

Can anyone please provide a solution for optional custom grok pattern

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

姐不稀罕 2025-02-14 12:15:08

您可以尝试这种可能有帮助的grok模式

%{TIMESTAMP_ISO8601:timestamp}?%{SPACE}*%{DATA:log-level}?%{SPACE}*\[%{DATA:service}\,%{DATA:ZTraceId}\,%{DATA:ZSpanId}\] %{NUMBER:ProcessId} --- \[%{DATA:buglevel}\] %{DATA:class}: %{GREEDYDATA:message} %{GREEDYDATA:message} %{GREEDYDATA:message}

You can try this grok pattern which might help

%{TIMESTAMP_ISO8601:timestamp}?%{SPACE}*%{DATA:log-level}?%{SPACE}*\[%{DATA:service}\,%{DATA:ZTraceId}\,%{DATA:ZSpanId}\] %{NUMBER:ProcessId} --- \[%{DATA:buglevel}\] %{DATA:class}: %{GREEDYDATA:message} %{GREEDYDATA:message} %{GREEDYDATA:message}

回复收藏 0 原文

~没有更多了~