使用Logstash在错误记录中使用特殊字符的问题

时间:2018-01-31 08:49:58

标签: logstash logstash-configuration

我有很多关于Logstash配置的查询。我的应用程序基于Java,Spring Boot。我在pom.xml中添加了Logstash依赖项,并且已在logback.xml内为RollingFileAppender配置了logstash编码器。对于consoleAppender我没有这样做。

现在使用JSON格式在mylogs.log内正确形成了日志,但我在堆栈跟踪中看到了一些特殊字符\n\t,并在消息中看到了反斜杠字符\

(DispatcherServlet.java:897)\\n\\tat org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)\\n\\t... 79 common frames omitted\\n\",\"HOSTNAME \":\"algo-11\"}\n{\"@timestamp\":\"2018-01-31T11:10:48.848+04:00\",\"@version\":1,\"message\":\"{\\\"type\\\":\\\"API_REQUEST\\\",\\\"uid\\\":\\\"3b122a03-0502-4bba-a357-b6d0a42a9746\\\",\\\"sessionId\\\":\\\"AA09B7F5A64170D5040D981A1964C6FD\\\",\\\"remoteAddress\\\":\\\"0:0:0:0:0:0:0:1\\\",\\\"methodType\\\":\\\"POST\\\",\\\"headers\\\":\\\"{content-length=76, accept-language=en-US,en;q=0.9, cookie=JSESSIONID=825F454FB4988B1F4AB10DFDD048564D, postman-token=9abae84a-bb5d-aa2d-70ef-80ea5171b91d, origin=chrome-extension://fhbjgbiflinjbdggehcddcbncdddomop, accept=*/*, authorization={\\\\\\\"user\\\\\\\":\\\\\\\"swoo-admin\\\\\\\",\\\\\\\"password\\\\\\\":\\\\\\\"ZJnt8#gEkA$u9p9HAr\\\\\\\"}, host=localhost:3080, connection=keep-alive, content-type=application/json, cache-control=no-cache, accept-encoding=gzip, deflate, br, user-agent=Mozilla/5.0 (X11; Linux x86_64)  AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36}\\\",\\\"uri\\\":\\\"/user/login\\\",\\\"query\\\":null,\\\"contentType\\\":\\\"application/json\\\",\\\"requestTime\\\":\\\"2018-01-31 11:10:48.727\\\",\\\"responseTime\\\":\\\"2018-01-31 11:10:48.841\\\",\\\"executionTimeMillisecond\\\":114,\\\"requestPayload\\\":\\\"{\\\\n  \\\\\\\"countryCode\\\\\\\": \\\\\\\"+971\\\\\\\",\\\\n  \\\\\\\"phone\\\\\\\": \\\\\\\"545901009\\\\\\\",\\\\n  \\\\\\\"userType\\\\\\\": \\\\\\\"EMAIL\\\\\\\"\\\\n }\\\",\\\"responsePayload\\\":\\\"  {\\\\\\\"status\\\\\\\":\\\\\\\"FAIL\\\\\\\",\\\\\\\"statusCode\\\\\\\":1000,\\\\\\\"message\\\\\\\":\\\\\\\"Internal Server Error\\\\\\\",\\\\\\\"desc\\\\\\\":\\\\\\\"FAIL\\\\\\\",\\\\\\\"debug\\\\\\\":\\\\\\\"org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.IllegalArgumentException: non null key required\\\\\\\\n\\\\\\\\tat org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:982)\\\\\\\\n\\\\\\\\tat org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)\\\\\\\\n\\\\\\\\tat javax.servlet.http.HttpServlet.service(HttpServlet.java:648)\\\\\\\\n\\\\\\\\tat org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)\\\\\\\\n\\\\\\\\tat javax.servlet.http.HttpServlet.service(HttpServlet.java:729)\\\\\\\\n\\\\\\\\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:230)\\\\\\\\n\\\\\\\\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)\\\\\\\\n\\\\\\\\tat org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)\\\\\\\\n\\\\\\\\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)\\\\\\\\n\\\\\\\\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)\\\\\\\\n\\\\\\\\tat com.logstashauth.CustomAuthenticationFilter.doFilter(CustomAuthenticationFilter.java:46)\\\\\\\\n\\\\\\\\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)\\\\\\\\n\\\\\\\\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)\\\\\\\\n\\\\\\\\tat

如何配置设置以消除这些\n\t\字符?

1 个答案:

答案 0 :(得分:0)

我认为logstash mutate gsub是您问题的解决方案。如果我错了,请纠正我。

  

https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub