我有一個包含日志 log4j 的文件，我無法為 logstash 編寫過濾器，它將返回僅包含 JSON 的日志input { file { path => "C:/logs/inlog.log" }} filter { #A lot of what I tried to write}output { file { path => "C:/logs/outlog.log" }}因此，我們需要一個過濾器來顯示包含 json 的日志。Json 日志被標記為 trace示例日志：[2019/08/02 11:21:52.472 MSK] [ 4] INFO ru.dmko.logstash.util.Utils - Initialized timer 'MyProject' with interval - 60000 [2019/08/02 11:21:53.769 MSK] [ 4] INFO ru.dmko.logstash.EventHandlerBean - EventHandler started [2019/08/02 11:21:56.535 MSK] [21] INFO ru.dmko.logstash.processors.MessageProcessorBean - {"glossary": {"title": "example glossary", "GlossDiv": {"title": "S", "GlossList": {"GlossEntry": {"ID": "SGML", "SortAs": "SGML", "GlossTerm": "Standard Generalized Markup Language", Acronym": "SGML", "Abbrev": "ISO 8879:1986", "GlossDef": { "para": "A meta-markup language, used to create markup languages such as DocBook.", "GlossSeeAlso": ["GML", "XML"]}, "GlossSee": "markup"}}}} [2019/08/02 11:21:56.551 MSK] [21] INFO ru.dmko.logstash.processors.MessageProcessorBean - Equal messages [2019/08/02 11:21:56.613 MSK] [21] INFO ru.dmko.logstash.processors.MessageProcessorBean - {"glossary": {"title": "example glossary", "GlossDiv": {"title": "S", "GlossList": {"GlossEntry": {"ID": "SGML", "SortAs": "SGML", "GlossTerm": "Standard Generalized Markup Language", Acronym": "SGML", "Abbrev": "ISO 8879:1986", "GlossDef": { "para": "A meta-markup language, used to create markup languages such as DocBook.", "GlossSeeAlso": ["GML", "XML"]}, "GlossSee": "markup"}}}} 其中，只需要看到兩個包含json
1 回答
江戶川亂折騰
TA貢獻1851條經驗 獲得超5個贊
我會用它來挑選 JSON
grok { match => { "message" => "%{JAVACLASS} - (?={)%{GREEDYDATA:json}" } }
如果您愿意，可以刪除 [tags] 中具有“_grokparsefailure”的 {} 消息
如果您將 JSON 修復為有效（將開頭“添加到首字母縮略詞并添加尾隨}），您可以使用解析它
json { source => json }
另一種（更便宜的）可能性，取決于“ - ”是否曾經出現在事件的其他上下文中
dissect { mapping => { "message" => "%{} - %{json}" } }
if [json] =~ /^{/ {
json { source => json }
} else {
drop {}
}
添加回答
舉報
0/150
提交
取消