Question

我有一个日志跟踪，我试图获取与我的grok匹配的行集enter code here

日志：

CNTR0020E: EJB threw an unexpected (non-declared) exception during invocation of method "getCustomerDashBoardCVAHistoricalDataRequestCount" on bean "BeanId(cva-admin-ear#vis-ejb-cva-4.20.0.0-SNAPSHOT.jar#CustomerDashboardServiceBean, null)". Exception data: java.lang.RuntimeException: com.ibm.websphere.naming.CannotInstantiateObjectException: Exception occurred while the JNDI NamingManager was processing a javax.naming.Reference object. [Root exception is com.ibm.websphere.ejbcontainer.AmbiguousEJBReferenceException: The short-form default binding 'za.co.sb.archiving.midtier.ejb.HistoricalDataRequestBusinessServiceRemote' is ambiguous because multiple beans implement the interface : [channel-frontendEAR#channel-biz-ejb-3-4.20.0.0-SNAPSHOT.jar#HistoricalDataRequestBusinessServiceBean, nbol-rest-0_0_1-20150729_102930-10_war#nbol-rest-0.0.1-20150729.102930-10.war#HistoricalDataRequestBusinessServiceBean]. Provide an interface specific binding or use the long-form default binding on lookup.]
    at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getRequestBusinessService(CustomerDashboardVisServicePojo.java:355)
    at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getHistoricalDataRequestCount(CustomerDashboardVisServicePojo.java:282)
    at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getCustomerDashBoardHistoricalDataRequestCount(CustomerDashboardVisServicePojo.java:249)
    at za.co.sb.channel.cva.customerdashboard.midtier.ejb.CustomerDashboardServiceBean.getCustomerDashBoardCVAHistoricalDataRequestCount(CustomerDashboardServiceBean.java:49)
    at za.co.sb.channel.cva.customerdashboard.midtier.ejb.EJSLocal0SLCustomerDashboardServiceBean_7d8a7f63.getCustomerDashBoardCVAHistoricalDataRequestCount(EJSLocal0SLCustomerDashboardServiceBean_7d8a7f63.java)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at za.co.sb.midtier.processservice.ProcessServiceImpl.callService(ProcessServiceImpl.java:770)
    at za.co.sb.midtier.processservice.ProcessServiceImpl.retrieveResultData(ProcessServiceImpl.java:1151)
    at za.co.sb.midtier.processservice.ProcessServiceImpl.process(ProcessServiceImpl.java:248)
    at za.co.sb.midtier.processservice.ProcessServiceBean.process(ProcessServiceBean.java:63)
    at za.co.sb.midtier.processservice.EJSRemote0SLCustomerAdminProcessService_450d08b4.process(EJSRemote0SLCustomerAdminProcessService_450d08b4.java)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
Caused by: com.ibm.websphere.naming.CannotInstantiateObjectException: Exception occurred while the JNDI NamingManager was processing a javax.naming.Reference object. [Root exception is com.ibm.websphere.ejbcontainer.AmbiguousEJBReferenceException: The short-form default binding 'za.co.sb.archiving.midtier.ejb.HistoricalDataRequestBusinessServiceRemote' is ambiguous because multiple beans implement the interface : [channel-frontendEAR#channel-biz-ejb-3-4.20.0.0-SNAPSHOT.jar#HistoricalDataRequestBusinessServiceBean, nbol-rest-0_0_1-20150729_102930-10_war#nbol-rest-0.0.1-20150729.102930-10.war#HistoricalDataRequestBusinessServiceBean]. Provide an interface specific binding or use the long-form default binding on lookup.]
    at com.ibm.ws.naming.util.Helpers.processSerializedObjectForLookupExt(Helpers.java:1103)
    at com.ibm.ws.naming.util.Helpers.processSerializedObjectForLookup(Helpers.java:796)
    at com.ibm.ws.naming.jndicos.CNContextImpl.processBoundObjectForLookup(CNContextImpl.java:2876)
    at com.ibm.ws.naming.jndicos.CNContextImpl.processResolveResults(CNContextImpl.java:3973)
    at com.ibm.ws.naming.jndicos.CNContextImpl.doLookup(CNContextImpl.java:1875)
    at com.ibm.ws.naming.jndicos.CNContextImpl.doLookup(CNContextImpl.java:1776)
    at com.ibm.ws.naming.jndicos.CNContextImpl.lookupExt(CNContextImpl.java:1433)
    at com.ibm.ws.naming.jndicos.CNContextImpl.lookup(CNContextImpl.java:615)
    at com.ibm.ws.naming.util.WsnInitCtx.lookup(WsnInitCtx.java:165)
    at com.ibm.ws.naming.util.WsnInitCtx.lookup(WsnInitCtx.java:179)
    at org.apache.aries.jndi.DelegateContext.lookup(DelegateContext.java:161)
    at

Grok模式：CUSTOM_ZACOSB（？：\ a *在za.co.sb. {5}？）

过滤器中的用法：

grok{
    match => ["ParseContent","%{CUSTOM_ZACOSB:ProjectLocation}"]
    add_tag => "ProjectLocation"
}

输出：“ProjectLocation”=＆gt; “在za.co.sb.chan”

预期产出：

at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getRequestBusinessService(CustomerDashboardVisServicePojo.java:355)
    at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getHistoricalDataRequestCount(CustomerDashboardVisServicePojo.java:282)
    at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getCustomerDashBoardHistoricalDataRequestCount(CustomerDashboardVisServicePojo.java:249)
    at za.co.sb.channel.cva.customerdashboard.midtier.ejb.CustomerDashboardServiceBean.getCustomerDashBoardCVAHistoricalDataRequestCount(CustomerDashboardServiceBean.java:49)
    at za.co.sb.channel.cva.customerdashboard.midtier.ejb.EJSLocal0SLCustomerDashboardServiceBean_7d8a7f63.getCustomerDashBoardCVAHistoricalDataRequestCount(EJSLocal0SLCustomerDashboardServiceBean_7d8a7f63.java)

有人能指出我在做错的地方。这将是非常有帮助的。我只希望那些五行不休息，我的过滤器能够找到内容，但它不会更进一步。如果我修改它捕获整个日志，我不想要。

Answer 1

看起来您并未将多行堆栈跟踪转换为单个消息以供logstash处理。 Filebeat和logstash都具有多行功能。收到一条消息后，您可以调整正则表达式。

如何使用logstash从日志中获取匹配'n'次的行集

1 个答案: