Grok 解析失败 - 过滤错误日志时

Question

您好，我遇到以下错误：

  "tags" => [
    [0] "beats_input_codec_plain_applied",
    [1] "_grokparsefailure"
]

我的 logstash-sample.conf 如下

input {
beats {
    port => "5044"
}
}

filter {
    grok {
         match => ["message","HTTPD20_ERRORLOG \[%{HTTPDERROR_DATE:timestamp}\] \[%{LOGLEVEL:loglevel}\] (?:\[client %{IPORHOST:clientip}\] )$
    }
}

output {
    stdout { codec => rubydebug }
}

谁能帮我我在这里做错了什么？也在图案中 {LOGLEVEL:loglevel}] (?:[client %{IPORHOST:clientip} 我需要指定 loglevel 和 clientip 吗？

我的日志示例：

 2020-10-09 14:24:33,489 [Thread1] INFO  ReceiverLogging- Connecting 
2020-10-09 14:24:34,166 [Thread1] INFO  ReceiverLogging- Connected...
2020-10-09 14:24:34,166 [Thread1] INFO  ReceiverLogging- Getting folder...
2020-10-09 14:24:34,167 [Thread1] INFO  ReceiverLogging- Got folder
2020-10-09 14:24:34,167 [Thread1] INFO  ReceiverLogging- Opening folder
2020-10-09 14:24:34,237 [Thread1] INFO  ReceiverLogging- getting folder 
2020-10-09 14:24:34,247 [Thread-6] ERROR CheckLog Error While Connecting to Websocket
javax.websocket.DeploymentException: The HTTP request to initiate the WebSocket connection failed
        at org.apache.tomcat.websocket.WsWebSocketContainer.connectToServer(WsWebSocketContainer.java:392)
        at org.apache.tomcat.websocket.WsWebSocketContainer.connectToServer(WsWebSocketContainer.java:150)
        at global.services.WebSocketClient.<init>(WebSocketClient.java:33)
        at global.services.WebSocketClient.getInstance(WebSocketClient.java:51)
        at global.services.SchedulerThread.run(SchedulerThread.java:63)
Caused by: java.util.concurrent.TimeoutException
        at sun.nio.ch.PendingFuture.get(PendingFuture.java:197)
        at org.apache.tomcat.websocket.WsWebSocketContainer.processResponse(WsWebSocketContainer.java:674)
        at org.apache.tomcat.websocket.WsWebSocketContainer.connectToServer(WsWebSocketContainer.java:340)
        ... 4 more
2020-10-09 14:24:34,248 [Thread-6] ERROR Exception- Error While Connecting to Websocket

请帮忙

Answer 1

首先，我建议了解 GROK 的一些基础知识及其工作原理。在答案末尾添加一些有用的资源。

您日志中的当前模式类似于 时间戳类名 LOGLEVEL LOGMESSAGE

以下问题中的日志示例是一个示例管道，但不确定是否需要多行来捕获堆栈跟踪。在这种情况下，可以扩展以下内容。

filter {
   grok{
     match =>  { "message" => "%{TIMESTAMP_ISO8601:timeStamp}%{SPACE}\[%{DATA:className}\]%{SPACE}%{LOGLEVEL:logLevel}%{SPACE}%{GREEDYDATA:message}"} 
     overwrite => [ "message" ]
   }
   date {
      match => ["timeStamp","yyyy-MM-dd HH:mm:ss,SSS"]
      timezone => "Europe/London"
      target => "@timestamp"
      remove_field => ["timeStamp"]
    }

}

输出事件如下所示

{
      "logLevel" => "INFO",
      "@version" => "1",
          "path" => "/usr/share/logstash/stack/data/data.log",
     "className" => "Classname",
          "host" => "95b3783b146a",
    "@timestamp" => 2020-10-09T13:24:35.004Z,
       "message" => "LOGG- Sending message : Test"
}
{
      "logLevel" => "ERROR",
      "@version" => "1",
          "path" => "/usr/share/logstash/stack/data/data.log",
     "className" => "Classname",
          "host" => "95b3783b146a",
    "@timestamp" => 2020-10-09T13:24:35.004Z,
       "message" => "InternetApp- in details."
}

Beginner's Guide

GROK Debugger

Basic GROK Pattern