Question

我将此消息作为输入：

Feb 18 04:35:46 xxxx zzzz-nginx_error 2016/02/18 04:35:39 [error] 28585#0: *3120 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client: xx.xx.xx.xx, server: xxxxxx, request: "HEAD / HTTP/1.1", upstream: "fastcgi://unix:/var/run/default.sock:", host: "xxxxxx"

我正在解析它：

  grok {
match => {
    "message" => [
            "(?<logstamp>\h{3} \d{2} \d{2}:\d{2}:\d{2}) (?<hostname>[^\s]+) (?<source>[^\s]+) (?<ngxstamp>[^\s]+ [^\s]+) %{GREEDYDATA:log}"
         }
   }

哪个没问题，但我也希望在client: xx.xx.xx.xx内保留%{GREEDYDATA:log}。

我已经尝试了

"(?<logstamp>\h{3} \d{2} \d{2}:\d{2}:\d{2}) (?<hostname>[^\s]+) (?<source>[^\s]+) (?<ngxstamp>[^\s]+ [^\s]+) %{DATA:log} (?<client>%{IP})%{GREEDYDATA:log}"

但这只会将输出分解为：

log: [error] 28585#0: *3120 FastCGI sent in stderr: "Primary script unknown" while reading response header from upstream, client:, , server: xxxxxx, request: "HEAD / HTTP/1.1", upstream: "fastcgi://unix:/var/run/default.sock:", host: "xxxxxx"
client: xx.xx.xx.xx

（注意IP从log截断）

我可以直接提取我需要的数据，还是应该加入以下内容：

  mutate {
replace => {
    "log" => "%{DATA:log} (?<client>%{IP})%{GREEDYDATA:log}"
           }
     }

Answer 1

我刚才意识到答案正在盯着我。这是模式：

"(?<logstamp>\h{3} \d{2} \d{2}:\d{2}:\d{2}) (?<hostname>[^\s]+) (?<source>[^\s]+) (?<ngxstamp>[^\s]+ [^\s]+) %{DATA:log} (?<client>%{IP})%{GREEDYDATA:log2}"

这就是加入：

  mutate {
replace => {
    "log" => "%{log} %{client}%{log2}"
           }
     }

Grok从匹配的模式中提取数据

1 个答案: