2回答

慕运维6574123

提问者

2018-08-31

input{stdin{}}

filter {

 # date {

  #  match => [ "logdate", "MMM dd yyyy HH:mm:ss" ]

  #}

  grok{

    match => {

       "message" => "%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] \"%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:response:int} (?:-|%{NUMBER:bytes:int}) %{QS:referrer} %{QS:agent} "

    }

  }

}

output{stdout{codec=>rubydebug}}

144.23.4.1 - - [13/Mar/2016:02:38:26 -0400] "GET /fancy.html HTTP/1.1" 200 6146 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:51.0) Gecko/ 20100101 Firefox/51.0"

{

      "@version" => "1",

       "message" => "144.23.4.1 - - [13/Mar/2016:02:38:26 -0400] \"GET /fancy.html HTTP/1.1\" 200 6146 \"-\" \"Mozilla/5.0 (X11; Linux x86_64; rv:51.0) Gecko/ 20100101 Firefox/51.0\"",

    "@timestamp" => 2018-08-31T03:17:42.978Z,

          "host" => "hadoop02",

          "tags" => [

        [0] "_grokparsefailure"

    ]

}

0

2

慕运维6574123

回复

rockybean

是的，谢谢老师，去了好了

2018-09-01

共2条回复

rockybean

2018-08-31

原始日志贴一下，报错信息也贴一下，logstash 相关配置也贴一下

0

2

慕运维6574123

grok debugger { "request": "/fancy.html", "agent": "\"Mozilla/5.0 (X11; Linux x86_64; rv:51.0) Gecko/ 20100101 Firefox/51.0\"", "auth": "-", "ident": "-", "verb": "GET", "referrer": "\"-\"", "response": 200, "bytes": 6146, "clientip": "144.23.4.1", "httpversion": "1.1", "timestamp": "13/Mar/2016:02:38:26 -0400" }

2018-08-31

共2条回复