Question

我在使用Grok调试器https://grokdebug.herokuapp.com/进行测试时使用代码和从Github下载的grok api（我没有使用logstash）解析日志文件时遇到问题它工作正常，但在我的代码中它赢了

这是我要解析的文件的日志行：

DEBUG 2015-06-17 14：44：57,475（com.test.logging.exceptionmanager.ExceptionTreeModel：findNodeByIdRecursively：651） - 找不到带有Id：1913的节点

这是我的代码：

public class LogParse {

public static void main(String[] args) throws GrokException {


        // Get an instance of grok
        Grok grok = new Grok();

        // add a pattern to grok
        grok.addPattern("LOGLEVEL", "\\w+");
        grok.addPattern("YEAR", "\\w+");
        grok.addPattern("MONTHNUM", "\\w+");
        grok.addPattern("MONTHDAY", "\\w+");
        grok.addPattern("HOUR", "\\w+");
        grok.addPattern("MINUTE", "\\w+");
        grok.addPattern("SECOND", "\\w+");
        grok.addPattern("GREEDYDATA", "\\w+");



     grok.compile("%{LOGLEVEL:loglevel} %{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} %{GREEDYDATA:data}");


        try{
               FileInputStream fstream = new FileInputStream("C://file.log");
               BufferedReader br = new BufferedReader(new InputStreamReader(fstream));
               String log;
                //output
                BufferedWriter output = new BufferedWriter(new FileWriter("out.json"));

               /* read log line by line */
               while ((log = br.readLine()) != null)   {

                 System.out.println (log);
                 Match gm = grok.match(log);
                    gm.captures();

                    //output
                    System.out.println(gm.toJson());
                    output.write(gm.toJson());
                    output.newLine();

               }
               output.close();
               fstream.close();

            } catch (Exception e) {
                 System.err.println("Error: " + e.getMessage());
            }       }}

感谢您的帮助。

Answer 1

工作代码：

 public class LogParse {
    public static void main(String[] args) throws GrokException, IOException {


        // Get an instance of grok
        Grok grok = new Grok();

        // add a pattern to grok
        grok.addPattern("LOGLEVEL", "\\w+");
        grok.addPattern("YEAR", "\\w+");
        grok.addPattern("MONTHNUM", "((?:0?[1-9]|1[0-2]))");
        grok.addPattern("MONTHDAY", "(?:[+-]?(?:[0-9]+))");
        grok.addPattern("HOUR", "(?:[+-]?(?:[0-9]+))");
        grok.addPattern("MINUTE", "(?:[+-]?(?:[0-9]+))");
        grok.addPattern("SECOND", "(?:(?:[0-5][0-9]|60)(?:[:.,][0-9]+)?)");
        grok.addPattern("GREEDYDATA", ".*");


        grok.compile("%{LOGLEVEL:loglevel} %{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} (%{GREEDYDATA:data}) - %{GREEDYDATA:message} %{GREEDYDATA:Erreur}");
        grok.compile("%{LOGLEVEL:loglevel} %{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{HOUR:hour}:%{MINUTE:minute}:%{SECOND:second} (%{GREEDYDATA:data}) - %{GREEDYDATA:message}");


        try{

               FileInputStream fstream = new FileInputStream("C://file.log");
               BufferedReader br = new BufferedReader(new InputStreamReader(fstream));
               String log;
                //output
                BufferedWriter output = new BufferedWriter(new FileWriter("out.json"));

               /* read log line by line */
               while ((log = br.readLine()) != null)   {

                 System.out.println (log);
                 Match gm = grok.match(log);
                    gm.captures();

                    //output
                    System.out.println(gm.toJson());
                    output.write(gm.toJson());
                    output.newLine();

               }
               output.close();
               fstream.close();

            } catch (Exception e) {
                 System.err.println("Error: " + e.getMessage());
            }   }}

使用java解析日志文件Grok api无法工作但在Grok在线调试器中工作

1 个答案: