我想删除
＆＃34; ＆＃34;
来自此消息。
＆lt; 189＆gt; date = 2018-03-02 time = 00:50:16 devname =＆＃34; TEST＆＃34; DEVID =＆＃34; AAAAA＆＃34; LOGID =＆＃34; 0000000013＆＃34;类型=＆＃34;流量＆＃34; 亚型=＆＃34;向前＆＃34;级=＆＃34;通知＆＃34; VD =＆＃34;根＆＃34; EVENTTIME = 1519980616 srcip = 111.111.111 srcport = 12345 srcintf =＆＃34; AAAAA＆＃34; srcintfrole =＆＃34;兰＆＃34; dstip = AAAAAAA dstport = 443 dstintf =＆＃34; port1＆＃34; dstintfrole =＆＃34;未定义＆＃34; poluuid =＆＃34; 52b23c9c-126C-51e8-84e1-38a5953285dc＆＃34; sessionid = 57002479 proto = 17 action =＆＃34; accept＆＃34;策略ID = 62 的PolicyType =＆＃34;策略＆＃34;服务=＆＃34; UDP_443＆＃34; dstcountry =＆＃34;美国＆＃34; srccountry =＆＃34;保留＆＃34; trandisp =＆＃34; SNAT＆＃34; transip = 123.123.123.123 transport = 55699 duration = 181 sentbyte = 4928 rcvdbyte = 5026 sentpkt = 9 rcvdpkt = 10 appcat =＆＃34;未扫描＆＃34;
我有这个过滤器：
grok {
match => ["message", "%{SYSLOG5424PRI:syslog_index}%{GREEDYDATA:message}"]
overwrite => [ "message" ]
tag_on_failure => [ "failure" ]
}
kv { }