正确的ELK多行正则表达式? [英] Correct ELK multiline regular expression?
本文介绍了正确的ELK多行正则表达式?的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！
问题描述
我是ELK的新手，我正在编写一个使用多行的配置文件，我们需要为输入数据编写一个模式
I am newbie to ELK and i'm writing a config file which uses multiline and we need to write a pattern for input data
110000|read|<soapenv:Envelope>
<head>hello<head>
<body></body>
</soapenv:Envelope>|<soapenv:Envelope>
<body></body>
</soapenv:Envelope>
210000|read|<soapenv:Envelope>
<head>hello<head>
<body></body>
</soapenv:Envelope>|<soapenv:Envelope>
<body></body>
</soapenv:Envelope>
370000|read|<soapenv:Envelope>
<head>hello<head>
<body></body>
</soapenv:Envelope>|<soapenv:Envelope>
<body></body>
</soapenv:Envelope>
和使用的配置文件是:
input {
file {
path => "/opt/test5/practice_new/xml_input.dat"
start_position => "beginning"
codec => multiline
{
pattern => "^%{INT}\|%{WORD}\|<soapenv:Envelope*>\|<soapenv"
negate => true
what => "previous"
}
}
}
filter {
grok {
match => [ "message", "%{DATA:method_id}\|%{WORD:method_type}\|%{GREEDYDATA:request}\|%{GREEDYDATA:response}" ]
}
}
output {
elasticsearch {
hosts => "http://localhost:9200"
index => "xml"
}
stdout {}
}
但是其中使用的模式不符合我的要求.
But the pattern used in it does not match for my requirement.
请给我建议正确的模式.
please suggest me the correct pattern.
预期输出:
对于第一个日志
method_id- 110000
method type-
request-
response-
第二次登录
method id- 210000
method type-
request-
response-
其余类似.
推荐答案
首先，您必须修复多行模式:
First of you'll have to fix your multiline pattern:
codec => multiline {
pattern => "^%{NUMBER:method_id}\|%{DATA:method_type}\|<soapenv:Envelope>"
negate => true
what => previous
}
之后，您可以在注释中使用Wiktor建议的模式:
Afterwards you can use the pattern Wiktor suggests in the comments:
(?m)^(?<method_id>\d+)\|(?<method_type>\w+)\|(?<request><soapenv:Envelope>.*?</soapenv:Envelope>)\|(?<response><soapenv:Envelope>.*?</soapenv:Envelope>)
您在 http://grokconstructor.appspot.com 上的帖子中的三个日志行的以下结果:
Following results for the three log lines in your post on http://grokconstructor.appspot.com:
您的整个配置可能如下所示:
Your whole config might look like this:
input {
file {
path => "/opt/test5/practice_new/xml_input.dat"
start_position => "beginning"
codec => multiline {
pattern => "^%{NUMBER:method_id}\|%{DATA:method_type}\|<soapenv:Envelope>"
negate => true
what => previous
}
}
}
filter {
grok {
match => [ "message", "(?m)^(?<method_id>\d+)\|(?<method_type>\w+)\|(?<request><soapenv:Envelope>.*?</soapenv:Envelope>)\|(?<response><soapenv:Envelope>.*?</soapenv:Envelope>)" ]
}
}
output {
elasticsearch {
hosts => "http://localhost:9200"
index => "xml"
}
stdout {}
}
这篇关于正确的ELK多行正则表达式?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
查看全文
