Question

我得到了以下以json格式记录的日志，什么是最好的记录方法，以便为Key创建字段。谢谢您的宝贵时间。

日志：

2018-10-17 16:20:04,358 WARNING VID_DROPS {"JITTER": 0.1, "INTVL": 6, "DATE": "Wed Oct 17 15:53:45 2018", "SOURCEIP": "192.168.12.1:22100", "ERRORS": 0.02, "LOSTPKT": 34, "FLOW": 116288, "MCAST": "239.0.1.102:1000", "SWITCH": "switc01", "INTERFACE": "TenGigE0/0/2/0", "CLASS": "Policy_VID"}

这是我得到的过滤器，似乎不起作用：

     grok  {
   match => {"message" => "%{TIMESTAMP_ISO8601:timestamp} %{WORD:loglevel} %{WORD:VID_DROPS} %{NOTSPACE:json1}" }
   remove_field => [ "message" ]
  } 
json { source => "json1" remove_field => [ "json1" ] }

Answer 1

正如提到的baudsp一样，您需要使用GREEDYDATA来匹配单词VID_DROPS之后的所有内容。此外，还有一个默认模式可用于匹配日志级别%{LOGLEVEL:loglevel}，因此您无需使用WORD，

%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{WORD:VID_DROPS} %{GREEDYDATA:json1}

将输出

{
  "timestamp": [
    [
      "2018-10-17 16:20:04,358"
    ]
  ],
  "YEAR": [
    [
      "2018"
    ]
  ],
  "MONTHNUM": [
    [
      "10"
    ]
  ],
  "MONTHDAY": [
    [
      "17"
    ]
  ],
  "HOUR": [
    [
      "16",
      null
    ]
  ],
  "MINUTE": [
    [
      "20",
      null
    ]
  ],
  "SECOND": [
    [
      "04,358"
    ]
  ],
  "ISO8601_TIMEZONE": [
    [
      null
    ]
  ],
  "loglevel": [
    [
      "WARNING"
    ]
  ],
  "VID_DROPS": [
    [
      "VID_DROPS"
    ]
  ],
  "json1": [
    [
      "{"JITTER": 0.1, "INTVL": 6, "DATE": "Wed Oct 17 15:53:45 2018", "SOURCEIP": "192.168.12.1:22100", "ERRORS": 0.02, "LOSTPKT": 34, "FLOW": 116288, "MCAST": "239.0.1.102:1000", "SWITCH": "switc01", "INTERFACE": "TenGigE0/0/2/0", "CLASS": "Policy_VID"}"
    ]
  ]
}

您可以在https://grokdebug.herokuapp.com/

进行测试

Logstash Grok错误

1 个答案: