Question

我在同一日志文件中有以下日志
declare @SQL nvarchar(max) set @SQL = '' ;with cols as ( select Table_Schema, Table_Name, Column_Name, Row_Number() over(partition by Table_Schema, Table_Name order by ORDINAL_POSITION) as RowNum from INFORMATION_SCHEMA.COLUMNS ) select @SQL = @SQL + case when RowNum = 1 then '' else ' union all ' end + ' select ''' + Column_Name + ''' as Column_Name, count(distinct ' + quotename (Column_Name) + ' ) As DistinctCountValue, count( '+ quotename (Column_Name) + ') as CountValue FROM ' + quotename (Table_Schema) + '.' + quotename (Table_Name) from cols where Table_Name = 'Employee' --print @SQL execute (@SQL)

2019-11-23T14:38:43.495 backendorg [http-nio-8080-exec-45] INFO http-nio-8080-exec-45 SessionController http://localhost:8080/ABC/session/login abc.nayak@zinier.com backendorg

使用下方过滤器基于字符串“ userSession ”来解析上方的消息。

2019-11-23T14:38:44.235 backendorg [http-nio-8080-exec-45] INFO  http-nio-8080-exec-45 SessionController userSession: backendorg 16CFAFCCFB14D9A3 16E978545E17BFEC 16E978545E1452FF

但是收到GROK分析器错误。任何建议都值得赞赏。

Answer 1

在filter中尝试一下：

filter {

      if "userSession" in [message]{
        grok {
        match => [ "message",
                 "%{TIMESTAMP_ISO8601:timestamp_match} %{USERNAME:orgId} (\[%{DATA:thread}\])?( )?%{LOGLEVEL:level}%{SPACE}%{USERNAME:zhost} %{JAVAFILE:javaClass} %{USERNAME:logmessage}:?%{SPACE}%{USERNAME:orgnisation}%{SPACE}%{USERNAME:loginUserId}%{SPACE}%{USERNAME:sessionId}%{SPACE}%{USERNAME:txnId}"]
          }
      } else {

      grok {
      match => [ "message",
               "%{TIMESTAMP_ISO8601:timestamp_match} %{USERNAME:orgId} (\[%{DATA:thread}\])?( )?%{LOGLEVEL:level}%{SPACE}%{USERNAME:zhost} %{JAVAFILE:javaClass} %{URI:url}%{SPACE}(?<email>[\w.+=:-]+@[0-9A-Za-z][0-9A-Za-z-]{0,62}(?:[.](?:[0-9A-Za-z][0-9A-Za-z‌-]{0,62}))*)%{SPACE}%{USERNAME:orgnisation}"]
        }
      }
}

Answer 2

对于电子邮件，您必须使用（Source）

(?<email>[a-zA-Z0-9_.+=:-]+@[0-9A-Za-z][0-9A-Za-z-]{0,62}(?:\.(?:[0-9A-Za-z][0-‌9A-Za-z-]{0,62}))*)

或

(?<email>[\w.+=:-]+@[0-9A-Za-z][0-9A-Za-z-]{0,62}(?:[.](?:[0-9A-Za-z][0-9A-Za-z‌-]{0,62}))*)

因此，您的比赛将变为

%{TIMESTAMP_ISO8601:timestamp_match} %{USERNAME:orgId} (\[%{DATA:thread}\])?( )?%{LOGLEVEL:level}%{SPACE}%{USERNAME:zhost} %{JAVAFILE:javaClass} %{URI:url}%{SPACE}(?<email>[\w.+=:-]+@[0-9A-Za-z][0-9A-Za-z-]{0,62}(?:[.](?:[0-9A-Za-z][0-9A-Za-z‌-]{0,62}))*)%{SPACE}%{USERNAME:orgnisation}

根据字符串过滤消息

2 个答案: