Logstash:来自日志的过滤器错误消息

时间:2018-12-21 16:37:14

标签: logstash

我正在使用Logstash解析和过滤数据。输入数据如下所示:

------------------------------------------------------
Environment File - 12/07/2018 09:31:19
------------------------------------------------------
-- File Name:  org/apache/catalina/core/ContainerBase/jboss/web/default-host/........... Path
------------------------------------------------------
Reading Environment Error File - 12/07/2018 09:31:19
------------------------------------------------------
-- File Name: org/apache/catalina/core/ContainerBase/jboss/web/default-host/.....
org/apache/catalina/core/ContainerBase/jboss/web/default-host........
.....Path.  Fri Dec  7 09:31:18 2018

Lock failed on recovery file org/apache/catalina/core/ContainerBase/jboss/web/default-host/
because the .......
....... text.

------------------------------------------------------
Reading Error  Files - 12/07/2018 09:31:19
------------------------------------------------------

错误消息包含多行并且没有通用模式。如何仅从日志中过滤错误?

1 个答案:

答案 0 :(得分:0)

听起来像在寻找multiline codec,您可以在其中指定描述消息的模式。 logstash(或filebeat)会将多行内容汇总到一个事件中。