Question

当解析多行编解码器的TIMESTAMP字段上的日志时，它显示方括号中的TIMESTAMP字段的错误输出。

配置：

input {
  file {
    path => "D:\logstash\logstash-2.4.0\bin\slowlogs.txt"
    start_position => "beginning"
    codec => multiline {
        pattern => "^%{TIMESTAMP_ISO8601} "
        negate => true
        what => previous
    }
  }
}

output {
  stdout { codec => rubydebug }
}

日志：

[2015-08-24 11:49:14,389] [INFO ][env                      ] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]
[2015-08-24 11:49:14,389] [INFO ][env                      ] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]
[2015-08-24 11:49:14,389] [INFO ][env                      ] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]

输出：

{
    "@timestamp" => "2017-05-23T11:19:10.635Z",
       "message" => "[2015-08-24 11:49:14,389] [INFO ][env
] [Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [
34.5gb], net total_space [118.9gb], types [hfs]\r\n[2015-08-24 11:49:14,389] [IN
FO ][env                      ] [Letha] using [1] data paths, mounts [[/\r\n(/de
v/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]\r\
n[2015-08-24 11:49:14,389] [INFO ][env                      ] [Letha] using [1]
data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [34.5gb], net total_s
pace [118.9gb], types [hfs]\r\n\r\n\r",
      "@version" => "1",
          "tags" => [
        [0] "multiline"
    ],
          "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt",
          "host" => "PC326815"
}

将相同的日志从[]

中删除

2015-08-24 11:49:14,389 [INFO ][env                      ] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]
2015-08-24 11:49:14,389 [INFO ][env                      ] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]
2015-08-24 11:49:14,389 [INFO ][env                      ] [Letha] using [1] data paths, mounts [[/
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]

执行相同的配置输出如下：

{
    "@timestamp" => "2017-05-23T11:25:48.075Z",
       "message" => "2015-08-24 11:49:14,389 [INFO ][env                      ]
[Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [3
.5gb], net total_space [118.9gb], types [hfs]\r",
      "@version" => "1",
          "tags" => [
        [0] "multiline"
    ],
          "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt",
          "host" => "PC326815"
}
{
    "@timestamp" => "2017-05-23T11:25:48.278Z",
       "message" => "2015-08-24 11:49:14,389 [INFO ][env                      ]
[Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [3
.5gb], net total_space [118.9gb], types [hfs]\r",
      "@version" => "1",
          "tags" => [
        [0] "multiline"
    ],
          "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt",
          "host" => "PC326815"
}
←[33mSIGINT received. Shutting down the agent. {:level=>:warn}←[0m
stopping pipeline {:id=>"main"}
{
    "@timestamp" => "2017-05-23T11:25:57.421Z",
       "message" => "2015-08-24 11:49:14,389 [INFO ][env                      ]
[Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [3
.5gb], net total_space [118.9gb], types [hfs]\r\n\r\n\r",
      "@version" => "1",
          "tags" => [
        [0] "multiline"
    ],
          "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt",
          "host" => "PC326815"
}

这给了我正确的输出。如何为[]括号中的TIMESTAMP字段实现相同的效果。

我也通过给出pattern =＆gt;来尝试它"^\[%{TIMESTAMP_ISO8601}\] " 致谢

Answer 1

问题在于我在输入中提到的多线模式。它必须像这样：

input {
  file {
    path => "D:\logstash\logstash-2.4.0\bin\slowlogs.txt"
    start_position => "beginning"
    codec => multiline {
        pattern => "^\[%{TIMESTAMP_ISO8601:TIMESTAMP}\]"
        negate => true
        what => previous
    }
  }
}

output {
  stdout { codec => rubydebug }
}

多行编解码器错误？

1 个答案: