Question

我需要从路径中提取特定位置的值...

示例：假设我使用“ \”作为拆分字符将以下路径拆分为数组 E：\ OUM82 \ APP \ Logs \ UploadManager_20062019.log 我应该得到这样的东西：

[0]=E:
[1]=OUM82
[2]=APP (this value I want to take into a field  )
[3]=logs
[4]=UploadManager_20062019.log

所以，我总是想拿[2]中的任何东西我该如何实施？红宝石吗？

编辑：

我尝试了这种方法：（建议使用@baudsp）但我仍然收到“ _grokparsefailure”

grok {
              match => { path => "%{GREEDYDATA:pathDriveSign}\\%{GREEDYDATA:RootFolder}\\%{GREEDYDATA:customerFolder}" }
           }

这是标准输出：

{
      "tags" => [
    [0] "beats_input_codec_plain_applied",
    [1] "_grokparsefailure"
],
     "agent" => {
            "type" => "filebeat",
    "ephemeral_id" => "bd6ace26-79cd-4297-bfb5-5add9f4b4217",
              "id" => "83fb6261-5872-4d95-853a-44f2cc41d436",
         "version" => "7.0.0",
        "hostname" => "OctUpload"
},
   "message" => "2019-06-13 17:40:34,591 INFO QueriesParserEngine.Run - GSP queries parser engine end. Total run time duration: 00:02:32.1831164 ",
"@timestamp" => 2019-06-22T16:25:26.204Z,
     "cloud" => {
    "provider" => "az",
     "machine" => {
        "type" => "Standard_DS13_v2"
    },
      "region" => "westeurope",
    "instance" => {
        "name" => "OctUpload",
          "id" => "768097b1-bfb9-4939-b99c-5337aede39ca"
    }
},
 "extractor" => "SQLSERVER",
     "input" => {
    "type" => "log"
},
       "ecs" => {
    "version" => "1.0.0"
},
  "@version" => "1",
    "fields" => {
    "logtype" => "log4net"
},
      "host" => {
              "os" => {
           "build" => "14393.2608",
         "version" => "10.0",
            "name" => "Windows Server 2016 Datacenter",
        "platform" => "windows",
          "kernel" => "10.0.14393.2608 (rs1_release.181024-1742)",
          "family" => "windows"
    },
              "id" => "d79c20df-4184-41a8-b95d-83669c8e3fbe",
            "name" => "OctUpload",
    "architecture" => "x86_64",
        "hostname" => "OctUpload"
},
       "log" => {
      "file" => {
        "path" => "E:\\OUM82\\Micron\\TI_DS_FILES\\SQLSERVER_LOGS\\QueriesParser-SQLS-BOMSSPROD66-2_13062019_173801 - Copy.log"
    },
    "offset" => 927068
}

}

Answer 1

注意事项：我不确定这是否是最好的过滤器，但这是我使用最多的过滤器，应该可以使用。

如果您只对路径的APP部分感兴趣，则应该可以使用grok过滤器进行检索。

假设您的路径位于名为path的字段中：

grok {
   match => {path => "^%{DATA}\\%{DATA}\\%{DATA:value}\\"}
}

过滤器会将值APP放在value字段中。

有关grok过滤器的更多信息：

Answer 2

ELK团队的Badger提出的另一个更好的解决方案：

better solution by Badger from ELK team

您不能使用mutate + split（这是我通常会做的事情）   建议），因为此issue会影响正则表达式，单引号   字符串，并用双引号引起来的字符串。

如果启用了config.support_escapes，则可以使用grok   logstash.yml ...信不信由你信了
grok { 
   match => { "path" =>
     "^(?<pathDriveSign>\w{1}):\\\\(?<RootFolder>[^\\\\]+)\\\\(?<customerFolder>[^\\\\]+)\\\\."
   } 
}
会帮助您
"RootFolder" => "OUM82",  
"pathDriveSign" => "E", 
"customerFolder" => "APP",
不要让我解释为什么需要4个反斜杠来代表一个   单反斜杠。


还有一种偷偷摸摸的方法来使用红宝石。你不能有一个   字符串末尾的反斜杠，所以我们有一个字符串，其中包含   反斜杠并从中提取反斜杠。
ruby {
    code => '
        backslash = "\\Z"[0]
        event.set("components", event.get("path").split(backslash))
    '
}
产生
"components" => [
 [0] "E:",
 [1] "OUM82",
 [2] "APP",
 [3] "Logs",
 [4] "UploadManager_20062019.log" 
]

logstash拆分路径，并通过其位置[2]取某个值并将其插入字段

2 个答案: