如何在 ApacheNifi 中使用 ExtractGrok 处理器获取多行? [英] How to fetch multiline with ExtractGrok processor in ApacheNifi?

问题描述

我要将日志文件事件(由 LogAttribute 处理器记录)转换为 JSON.

I am going to convert a log file events (which is recorded by LogAttribute processor) to JSON.

我在此配置中使用 ExtractGrok:

模式文件中的堆栈模式是(?m).*

STACK pattern in pattern file is (?m).*

每个日志的格式如下:

2019-11-21 15:26:06,912 INFO [Timer-Driven Process Thread-4] org.apache.nifi.processors.standard.LogAttribute LogAttribute[id=143515f8-1f1d-1032-e7d2-8c07f50d1c5a] logging for flow file StandardFlowFileRecord[uuid=02eb9f21-4587-458b-8cee-ad052cb8e634,claim=StandardContentClaim [resourceClaim=StandardResourceClaim[id=1574339166853-1, container=default, section=1], offset=0, length=0],offset=0,name=0df20cc1-3f93-49df-81b1-dac18318ccd9,size=0]
------------- request was received----------
Standard FlowFile Attributes
Key: 'entryDate'
    Value: 'Thu Nov 21 15:26:06 AST 2019'
Key: 'lineageStartDate'
    Value: 'Thu Nov 21 15:26:06 AST 2019'
Key: 'fileSize'
    Value: '0'
FlowFile Attribute Map Content
Key: 'filename'
    Value: '0df20cc1-3f93-49df-81b1-dac18318ccd9'
Key: 'http.context.identifier'
    Value: '9552bd22-ec3b-4ada-93a9-a5ce9b27de25'
Key: 'path'
    Value: './'
Key: 'uuid'
    Value: '02eb9f21-4587-458b-8cee-ad052cb8e634'
-------------- request was received----------

我希望在日志中保存第一行之后的其余消息，但我只得到第一行:

I expect rest of the message after first line saved in log, but I get only first line:

-------------- request was received----------

我检查了 Grok Debugger 中的表达式，它工作正常.但它不适用于 NiFi.

I check the expression in Grok Debugger and it works. but it doesn't work with NiFi.

如何配置 ExtractGrok 以获取日志值中的所有行?

How to config ExtractGrok to get all lines in log value?

推荐答案

我找到了解决方案，我将 (?m).* 替换为这个 (?s).* 并且它有效.

I found the solution, I replace (?m).* with this one (?s).* and it works.

这篇关于如何在 ApacheNifi 中使用 ExtractGrok 处理器获取多行?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！