沙师弟,师父的充电器掉了

logstash filter 为什么不成功

Logstash | 作者 saga | 发布于2017年08月16日 | 阅读数:3436




[2017-08-16T10:07:31,815][DEBUG][logstash.pipeline ] filter received {"event"=>{"@timestamp"=>2017-08-16T02:07:31.809Z, "port"=>59524, "@version"=>"1", "host"=>"127.0.0.1", "message"=>"20170815202020 GS_1_1 [Test] [Debug]I am Chuck Norris! \r"}}
[2017-08-16T10:07:31,816][DEBUG][logstash.filters.grok ] Running grok filter {:event=>2017-08-16T02:07:31.809Z 127.0.0.1 20170815202020 GS_1_1 [Test} [Debug]I am Chuck Norris!
[2017-08-16T10:07:31,818][DEBUG][logstash.filters.grok ] Event now: {:event=>2017-08-16T02:07:31.809Z 127.0.0.1 20170815202020 GS_1_1 [Test] [Debug}I am Chuck Norris!
[2017-08-16T10:07:31,820][DEBUG][logstash.pipeline ] output received {"event"=>{"@timestamp"=>2017-08-16T02:07:31.809Z, "port"=>59524, "@version"=>"1", "host"=>"127.0.0.1", "message"=>"20170815202020 GS_1_1 [Test] [Debug]I am Chuck Norris! \r", "tags"=>["_grokparsefailure"]}}

我的日志是message里面的,为什么不成功
grok {
13 patterns_dir => ["./config/grok.patterns"]
match => { "message" => "%{DATESTAMP_EVENTLOG:logtime} %{IDENTIFY:identify} [%{WORD:logtype}] [%{LOGLEVEL:loglevel}]%{DATA:text}" }
}

IDENTIFY [a-zA-Z]{2}_[0-9]_[0-9]
已邀请:

白衬衣 - 金桥

赞同来自: saga

这个日志已经明确告诉你是正则解析失败了啊。
去 grokdebug.herokuapp.com 调试下正则。

要回复问题请先登录注册