如何在ApacheNifi中使用ExtractGrok处理器获取多行? [英] How to fetch multiline with ExtractGrok processor in ApacheNifi?

问题描述

我打算将日志文件事件(由LogAttribute处理器记录)转换为JSON.

I am going to convert a log file events (which is recorded by LogAttribute processor) to JSON.

我在此配置中使用"ExtractGroke":

I am using 'ExtractGroke' with this configuration:

模式文件中的STACK模式为(?m).*

STACK pattern in pattern file is (?m).*

每个日志具有以下格式:

Each log has this format:

2019-11-21 15:26:06,912 INFO [Timer-Driven Process Thread-4] org.apache.nifi.processors.standard.LogAttribute LogAttribute[id=143515f8-1f1d-1032-e7d2-8c07f50d1c5a] logging for flow file StandardFlowFileRecord[uuid=02eb9f21-4587-458b-8cee-ad052cb8e634,claim=StandardContentClaim [resourceClaim=StandardResourceClaim[id=1574339166853-1, container=default, section=1], offset=0, length=0],offset=0,name=0df20cc1-3f93-49df-81b1-dac18318ccd9,size=0]
------------- request was received----------
Standard FlowFile Attributes
Key: 'entryDate'
    Value: 'Thu Nov 21 15:26:06 AST 2019'
Key: 'lineageStartDate'
    Value: 'Thu Nov 21 15:26:06 AST 2019'
Key: 'fileSize'
    Value: '0'
FlowFile Attribute Map Content
Key: 'filename'
    Value: '0df20cc1-3f93-49df-81b1-dac18318ccd9'
Key: 'http.context.identifier'
    Value: '9552bd22-ec3b-4ada-93a9-a5ce9b27de25'
Key: 'path'
    Value: './'
Key: 'uuid'
    Value: '02eb9f21-4587-458b-8cee-ad052cb8e634'
-------------- request was received----------

我希望第一行保存在日志中之后的其余消息，但我只会得到第一行-------------- request was received----------.

I expect rest of the message after first line saved in log, but I get only first line -------------- request was received----------.

我在 Grok调试器中检查该表达式，并且可以正常工作.但不适用于NiFi.

I check the expression in Grok Debugger and it works. but it doesn't work with NiFi.

如何配置ExtractGrok以获取日志值中的所有行?

How to config ExtractGrok to get all lines in log value?

推荐答案

我找到了解决方案，我用这个(?s).*替换了(?m).*，它可以工作.

I found the solution, I replace (?m).* with this one (?s).* and it works.

这篇关于如何在ApacheNifi中使用ExtractGrok处理器获取多行?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！