具有双倍空间的Grok调试问题

时间:2017-12-12 10:37:51

标签: logstash-grok

我有以下使用log4net生成的日志

2017-12-11 17:01:28,390 [6] INFO  DAL.DBManager "FunctionName":"Dispose" 

问题是INFO之后的2个空格。如果单词是debug,它似乎只有1个空格,所以它可能是“tab”。

我正在使用http://grokdebug.herokuapp.com/,但下面的模式似乎不起作用。

%{TIMESTAMP_ISO8601} \[%{NUMBER:thread}\] %{LOGLEVEL:log-level} %{DATA:CLASS} %{DATA:Function} %{DATA:FunctionName} %{GREEDYDATA:remainder}

我尝试添加%{SPACE}而不是空格,但它不会生成任何内容。

1 个答案:

答案 0 :(得分:1)

如果你想要恰好匹配两个空格,你必须在你的模式中添加两个空格。以下模式似乎与您所写的行匹配:

///add new chat
router.post('/add', passport.authenticate('jwt',{session:false}), (req,res,next) => {
    //validation
    if(!req.user._id){ res.json({status:false, message:'something went wrong, please sign-in first and try again'}) }
    if(req.user._id != req.body.user){ res.json({status:false, message:'something went wrong, please sign-in first and try again'}) }
    if(!req.body.room){ res.json({status:false, message:'something went wrong, please refresh the page and try again'}) }
    if(!req.body.text){ res.json({status:false, message:'you have to fill a chat message to add it'}) }
    next();
}, (req, res) => {
    //create new one 
    let chatData = new Chat(req.body);

    //do create
    Chat.create(chatData, (err, chat)=>{
        //error 
        if(err){ res.josn({status:false, message:err.message})}
        else{
            //replace user id to user data
            chat.user = req.user;
            //define socketio
            let socket     = req.app.get('socket');
            //emit new message
            socket.broadcast.emit('chatroom-'+chat.room, chat);
            //return respone
            res.json({status:true, message:'the message has been sent', chat:chat})
        }
    })
});

如果要匹配一个或两个空格,可以使用空格和可选空格%{TIMESTAMP_ISO8601} \[%{NUMBER:thread}\] %{LOGLEVEL:log-level} %{DATA:CLASS}\.%{DATA:Function} %{DATA:FunctionName}\:%{GREEDYDATA:remainder} ,如下所示:

( )?