自定义指标的Grok帮助

Question

我有这样一条日志行：

09 Nov 2018 15:51:35 DEBUG  api.MapAnythingProvider - Calling API For Client: XXX Number of ELEMENTS Requested YYY

我要忽略所有其他日志行，而只希望其中包含单词“ 为客户端调用API ”的行。此外，我只对字符串XXX和数字YYY感兴趣。 感谢您的帮助。

Answer 1

input {
 file {
   path => ["C:/apache-tomcat-9.0.7/logs/service/service.log"]
   sincedb_path => "nul"
   start_position => "beginning"
  }
}
filter {
    grok {
    match => {
      "message" => "%{MONTHDAY:monthDay} %{MONTH:mon} %{YEAR:year} %{TIME:ts} %{WORD:severity}  %{JAVACLASS:claz} - %{GREEDYDATA:logmessage}"
      }
    }   

    grok {
    match => {
      "logmessage" => "%{WORD:keyword} %{WORD:customer} %{WORD:key2} %{NUMBER:mapAnythingCreditsConsumed:float} %{WORD:key3} %{NUMBER:elementsFromCache:int}"
      }
    }   

    if "_grokparsefailure" in [tags] {
    drop {}
    }

    mutate {
    remove_field => [ "monthDay", "mon", "ts", "severity", "claz", "keyword", "key2", "path", "message", "year", "key3" ]
    }
}
output {
        if [logmessage] =~ /ExecutingJobFor/  { 
        elasticsearch {
            hosts => ["localhost:9200"]
            index => "test"
            manage_template => false
        }
        stdout {
            codec => rubydebug
        }
        }
}