Question

输入是以下消息文本：

@ConditionOnProperty(prefix="status.", value="host", havingValue=System.getProperty("hostName")  // property set elsewhere

这是我的logstash配置的过滤器部分：

@ConditionalOnProperty

然后我的时间戳如下：

{"timestamp":"2018-08-02 15:56:46,569","level":"DEBUG","class":"classname","method":"run","line":"730","thread":"threadname","message":"messagetext"}

并且我无法删除/擦除“：”的首次出现。我已经尝试过

filter {
  if "pattern_09" in [tags] {
    mutate {
      gsub => [ "message" , "{" , "",
                "message" , "}" , "" ] }
    dissect {
      mapping => { "message" => "%{Timestamp},%{+Timestamp/2},%{level},%{class},%{method},%{line},%{thread},%{mymessage}"}
    }
    mutate {
      gsub => [ "Timestamp" , "timestamp", "",
                "Timestamp" , "\"", "" ,
                "level" , "level" , "" ,
                "level" , ":", "" ,
                "level" , "\"", "" ,
                "class" , "class" , "" ,
                "class" , ":", "" ,
                "class" , "\"", "" ,
                "method" , "method" , "" ,
                "method" , ":", "" ,
                "method" , "\"", "" ,
                "line" , "line" , "" ,
                "line" , ":", "" ,
                "line" , "\"", "" ,
                "thread" , "thread" , "" ,
                "thread" , ":", "" ,
                "thread" , "\"", "" ,
                "mymessage" , "mymessage" , "" ,
                "mymessage" , ":", "",
                "mymessage" , "\"", "" ]
    }
    date {
      match => [ "Timestamp", "yyyy-dd-MM HH:mm:ss,SSS" ]
    }
  }
}

但这没有效果。

Answer 1

为什么不使用grok过滤器？这样的模式匹配要方便得多。

对于上面的示例，可以按以下步骤完成

grok {
  match => ["message" ,'%{GREEDYDATA}"timestamp":"%{DATA:Timestamp}"%{GREEDYDATA}"level":"%{DATA:Level}"%{GREEDYDATA}"class":"%{DATA:Class}"%{GREEDYDATA}"method":"%{DATA:Method}"%{GREEDYDATA}"line":"%{DATA:Line}"%{GREEDYDATA}"thread":"%{DATA:Thread}"%{GREEDYDATA}"message":"%{DATA:Message}"%{GREEDYDATA}']
}

date {
  match => [ "Timestamp", "yyyy-dd-MM HH:mm:ss,SSS" ]
}

DATA和GREEDYDATA只是模式，我们可以在这里使用更多的模式：https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns

这里有更多关于grok过滤器的信息：https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html，您可以在这里测试您的grok模式：https://grokdebug.herokuapp.com/

使用Dissect进行日志解析

1 个答案: