Grok模式匹配电子邮件地址 [英] Grok pattern to match email address

问题描述

我在模式文件中定义了以下Grok模式

  HOSTNAME \ b(?:[0-9A-Za-z] [0-9A-Za-z-] {0,62})(?:\.(?:[0-9A-Za-z] [0-9A-Za-z-] {0,62}))*(\.?| \ b)EMAILLOCALPART [a-zA-Z] [a-zA-Z0-9 _.+-=:] +电子邮件地址％{EMAILLOCALPART} @％{HOSTNAME} 

由于某些原因，当针对 http://grokdebug.herokuapp.com/运行时，此编译不正确输入以下内容，它仅返回编译错误"

  Node1 \ Spam.log.2016-05-03 171 1540699703 03/May/2016 00:00:01 +0000 INFO [http-bio-0.0.0.0-8001-exec-20429] EngagementServiceImpl logDefault 192.168.1.122 77777777777777777 [e-mail]>初始的东西:8675309，提供者:8675309，成员:8675309 

是否有某些原因导致我收到编译错误/这是否与该日志行中的电子邮件匹配?

谢谢

解决方案

您可以使用

 (?< email> [a-zA-Z0-9 _.+ =:-] + @ [0-9A-Za-z] [0-9A-Za-z-] {0，62}(?:\.(?:[0-9A-Za-z] [0-‌9A-Za-z-] {0,62})*) 

或:

 (?< email> [\ w.+ =:-] + @ [0-9A-Za-z] [0-9A-Za-z-] {0,62}(?:[.](?:[0-9A-Za-z] [0-9A-Za-z‌-] {0,62})))) 

它们在 grokdebug.herokuapp.com 工作.顺便说一句， https://github.com/rgevaert/grok-pattern/blob/master/grok.d/postfix_patterns 不同地定义了电子邮件模式: EMAILADDRESS％{EMAILADDRESSPART:local} @％{EMAILADDRESSPART:remote} ，它也可能起作用.>

I have the following Grok patterns defined in a pattern file

HOSTNAME \b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)
EMAILLOCALPART [a-zA-Z][a-zA-Z0-9_.+-=:]+
EMAILADDRESS %{EMAILLOCALPART}@%{HOSTNAME}

For some reason this doesn't compile when run against http://grokdebug.herokuapp.com/ with the following input, it simply returns "Compile error"

Node1\Spam.log.2016-05-03   171 1540699703 03/May/2016 00:00:01 +0000  INFO  [http-bio-0.0.0.0-8001-exec-20429] EngagementServiceImpl logDefault 192.168.1.122 77777777777777777 [e-mail] > initiated Stuff: 8675309, provider: 8675309, member: 8675309

Is there some reason I'm getting a compile error / will this even match the email in that log line?

Thanks,

解决方案

You may use

(?<email>[a-zA-Z0-9_.+=:-]+@[0-9A-Za-z][0-9A-Za-z-]{0,62}(?:\.(?:[0-9A-Za-z][0-‌​9A-Za-z-]{0,62}))*)

or:

(?<email>[\w.+=:-]+@[0-9A-Za-z][0-9A-Za-z-]{0,62}(?:[.](?:[0-9A-Za-z][0-9A-Za-z‌​-]{0,62}))*)

They work at grokdebug.herokuapp.com. BTW, https://github.com/rgevaert/grok-patterns/blob/master/grok.d/postfix_patterns defines the email pattern differently: EMAILADDRESS %{EMAILADDRESSPART:local}@%{EMAILADDRESSPART:remote}, it may also work.

这篇关于Grok模式匹配电子邮件地址的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！