Question

我有每个事件所在的日志：

ExitNode FF33F91CC06B6CC5C3EE804E7D8DBE42CB5707F9
Published 2017-11-05 02:55:09
LastStatus 2017-11-05 04:02:27
ExitAddress 66.42.224.235 2017-11-05 04:06:26

我尝试使用多线：

input {
   file {
     path => "/path/input"
   }
}
filter {
  multiline {
    pattern => "^\b[A-Za-z]{8}\b"
      what => "next"
  }
}
filter {
  multiline {
    pattern => "^\b[A-Za-z]{8}\b"
      what => "next"
  }
}
filter {
  multiline {
    pattern => "^\b[A-Za-z]{11}\b"
      what => "previous"
  }
}
output {
  file {
    codec => rubydebug
    path => "/path/output"
  }
}

我得到这样的东西：

{
          "path" => "/path/input",
    "@timestamp" => 2017-11-05T10:25:34.112Z,
      "@version" => "1",
          "host" => "HOST",
       "message" => "ExitNode FE3CB742E73674F1BC2382723209ECEE44AD4AEC\nPublished 2017-11-04 20:34:55\nLastStatus 2017-11-04 21:03:26\nExitAddress 77.250.227.12 2017-11-04 21:06:45",
          "tags" => [
        [0] "multiline"
    ]
}

我无法理解此消息字段，因为我不知道如何删除或替换\n并且gsub => ["message", "\n", "Line_Break"]无法正常工作。感谢

Answer 1

来自@baudsp的评论：

git merge-base

无法理解多行日志

1 个答案: