Logstash系列： grok拦截器的使用

​目录​

​​定位​​

​​整行匹配​​

​​字段匹配​​

​​Demo ​​

定位

将字符串结构化（字符串映射到具体字段上）

整行匹配

#原始数据
55.3.244.1 GET /index.html 15824 0.043
#grok

%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}
#demo

input {
      file {
        path => "/var/log/http.log"
      }
    }
    filter {
      grok {
        match => { "message" => "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" }
      }
    }

#结果

client: 55.3.244.1

method: GET

request: /index.html

bytes: 15824

duration: 0.043

字段匹配

May 29 16:37:11 sadness logger: hello world

filter {
      grok {
        match => { "message" => "%{SYSLOGBASE} %{DATA:message}" }
        overwrite => [ "message" ]
      }
    }

Demo 

日志

grok 

输出

备注

​SYSLOGBASE ​是logstash自带的表达式

​SYSLOGBASE ​%{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:

COMMONAPACHELOG %{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] “(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})” %{NUMBER:response} (?:%{NUMBER:bytes}|-)

COMBINEDAPACHELOG %{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}