大神们好，请问我在grok把每一个字段都匹配出来了，可以输出打印的时候还是没有一一对应，请问有什么好的办法吗，谢谢
elk版本是6.4.2 运行环境是centos7
{
"@timestamp" => 2020-02-14T02:40:30.268Z,
"@version" => "1",
"host" => "172.16.4.41",
"message" => "<134>1 2020-02-14T02:40:30Z CP5200 CheckPoint 30481 - [action:\"Accept\"; flags:\"411908\"; ifdir:\"inbound\"; ifname:\"eth1\"; logid:\"0\"; loguid:\"{0x5e46089d,0x15,0x290410ac,0xc0000001}\"; origin:\"172.16.4.41\"; originsicname:\"cn=cp_mgmt,o=CP5200..wjdgrg\"; sequencenum:\"7\"; time:\"1581648030\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={5685AB0E-D30D-3348-ADB3-9EE7F22DBD9A};mgmt=CP5200;date=1581585982;policy_name=Standard\\]\"; dst:\"172.16.30.253\"; inzone:\"External\"; layer_name:\"Network\"; layer_uuid:\"50c71672-c7da-40cb-92ae-5c10d61f6739\"; match_id:\"101\"; parent_rule:\"0\"; rule_action:\"Accept\"; rule_uid:\"60c29c74-96c6-4b1d-8f00-6e41fbb7ad5b\"; outzone:\"Internal\"; product:\"VPN-1 & FireWall-1\"; proto:\"6\"; s_port:\"9408\"; service:\"80\"; service_id:\"http\"; src:\"27.23.177.28\"; ]\n"
}
elk版本是6.4.2 运行环境是centos7
{
"@timestamp" => 2020-02-14T02:40:30.268Z,
"@version" => "1",
"host" => "172.16.4.41",
"message" => "<134>1 2020-02-14T02:40:30Z CP5200 CheckPoint 30481 - [action:\"Accept\"; flags:\"411908\"; ifdir:\"inbound\"; ifname:\"eth1\"; logid:\"0\"; loguid:\"{0x5e46089d,0x15,0x290410ac,0xc0000001}\"; origin:\"172.16.4.41\"; originsicname:\"cn=cp_mgmt,o=CP5200..wjdgrg\"; sequencenum:\"7\"; time:\"1581648030\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 & FireWall-1[db_tag={5685AB0E-D30D-3348-ADB3-9EE7F22DBD9A};mgmt=CP5200;date=1581585982;policy_name=Standard\\]\"; dst:\"172.16.30.253\"; inzone:\"External\"; layer_name:\"Network\"; layer_uuid:\"50c71672-c7da-40cb-92ae-5c10d61f6739\"; match_id:\"101\"; parent_rule:\"0\"; rule_action:\"Accept\"; rule_uid:\"60c29c74-96c6-4b1d-8f00-6e41fbb7ad5b\"; outzone:\"Internal\"; product:\"VPN-1 & FireWall-1\"; proto:\"6\"; s_port:\"9408\"; service:\"80\"; service_id:\"http\"; src:\"27.23.177.28\"; ]\n"
}
2 个回复
yang4210
赞同来自:
grok {
match => {
"message" => "(?<date_>\d+-\d+-\d+ \d+:\d+:\d+) \((?<domian>[^ ]+)\) (?<ip>[^ ]+)"
}
}
就会得到
date_ => "2020-02-02 12:12:12"
domian => "www.qq.com"
ip => "10.10.10.10"
当然，ip地址的正则可以细化，这里直接就用多个非空字符。
kingen9 - IT
赞同来自: