Logstash多行與系統日誌

我使用的是Logspout容器，所有的標準輸出日誌條目轉發的系統日誌，以logstash一些困難。

這是logstash收到的最終內容。這裏有多行代表兩個事件。

<14>2015-02-09T14:25:01Z logspout dev_zservice_1[1]: 2015-02-10 11:55:38.496 INFO 1 --- [tp1302304527-19] c.z.service.DefaultInvoiceService  : Creating with DefaultInvoiceService started... 
<14>2015-02-09T14:25:01Z logspout dev_zservice_1[1]: 2015-02-10 11:55:48.596 WARN 1 --- [tp1302304527-19] o.eclipse.jetty.servlet.ServletHandler : 
<14>2015-02-09T14:25:01Z logspout dev_zservice_1[1]: 
<14>2015-02-09T14:25:01Z logspout dev_zservice_1[1]: org.springframework.web.util.NestedServletException: Request processing failed; nested exception is org.springframework.dao.DataAccessResourceFailureException: Timed out after 10000 ms while waiting for a server that matches AnyServerSelector{}. Client view of cluster state is {type=Unknown, servers=[{address=mongo:27017, type=Unknown, state=Connecting, exception={com.mongodb.MongoException$Network: Exception opening the socket}, caused by {java.net.UnknownHostException: mongo: unknown error}}]; nested exception is com.mongodb.MongoTimeoutException: Timed out after 10000 ms while waiting for a server that matches AnyServerSelector{}. Client view of cluster state is {type=Unknown, servers=[{address=mongo:27017, type=Unknown, state=Connecting, exception={com.mongodb.MongoException$Network: Exception opening the socket}, caused by {java.net.UnknownHostException: mongo: unknown error}}] 
<14>2015-02-09T14:25:01Z logspout dev_zservice_1[1]: at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:978) 
<14>2015-02-09T14:25:01Z logspout dev_zservice_1[1]: at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:868) 
<14>2015-02-09T14:25:01Z logspout dev_zservice_1[1]: at javax.servlet.http.HttpServlet.service(HttpServlet.java:707) 
<14>2015-02-09T14:25:01Z logspout dev_zservice_1[1]: at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:842)

每條日誌行都以syslog頭開始。

根據上面的日誌內容我創建了logstash配置文件。

input { 
    udp { 
    port => 5000 
    type => syslog 
    } 
} 

filter { 
    multiline { 
    pattern => "^<%{NUMBER}>%{TIMESTAMP_ISO8601} %{SYSLOGHOST:container_name} %{DATA}(?:\[%{POSINT}\])?:%{SPACE}%{TIMESTAMP_ISO8601}" 
    negate => true 
    what => "previous" 
    stream_identity => "%{container_name}" 
    } 

    grok { 
    match => [ "message", "(?m)^<%{NUMBER}>%{TIMESTAMP_ISO8601} %{SYSLOGHOST} %{DATA:container_name}(?:\[%{POSINT}\])?:%{SPACE}%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{LOGLEVEL:loglevel}%{SPACE}%{NUMBER}%{SPACE}---%{SPACE}(?:\[%{DATA:threadname}\])?%{SPACE}%{JAVACLASS:clas 
    } 

    date { 
    match => [ "timestamp", "yyyy-MM-dd HH:mm:ss.SSS" ] 
    remove_field => ["timestamp"] 
    } 
    if !("_grokparsefailure" in [tags]) { 
    mutate { 
     replace => [ "source_host", "%{container_name}" ] 
     replace => [ "raw_message", "%{message}" ] 
     replace => [ "message", "%{logmessage}" ] 
     remove_field => [ "logmessage", "host", "source_host" ] 
    } 
    } 
    mutate { 
    strip => [ "threadname" ] 
    } 
} 

output { 
    elasticsearch { } 
}

現在，當上述事件到達的第一個事件是正確的分析和顯示：

message = "Creating with DefaultInvoiceService started..."

第二個事件包含此消息包含三個問題：

<14>2015-02-10T12:59:09Z logspout dev_zservice_1[1]: 

<14>2015-02-10T12:59:09Z logspout dev_zservice_1[1]: org.springframework.web.util.NestedServletException: Request processing failed; nested exception is org.springframework.dao.DataAccessResourceFailureException: Timed out after 10000 ms while waiting for a server that matches AnyServerSelector{}. Client view of cluster state is {type=Unknown, servers=[{address=mongo:27017, type=Unknown, state=Connecting, exception={com.mongodb.MongoException$Network: Exception opening the socket}, caused by {java.net.UnknownHostException: mongo: unknown error}}]; nested exception is com.mongodb.MongoTimeoutException: Timed out after 10000 ms while waiting for a server that matches AnyServerSelector{}. Client view of cluster state is {type=Unknown, servers=[{address=mongo:27017, type=Unknown, state=Connecting, exception={com.mongodb.MongoException$Network: Exception opening the socket}, caused by {java.net.UnknownHostException: mongo: unknown error}}] 

<14>2015-02-10T12:59:09Z logspout dev_zservice_1[1]: at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:978) 

<14>2015-02-10T12:59:09Z logspout dev_zservice_1[1]: at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:868) 

<14>2015-02-10T12:59:09Z logspout dev_zservice_1[1]: at javax.servlet.http.HttpServlet.service(HttpServlet.java:707) 

<14>2015-02-10T12:59:09Z logspout dev_zservice_1[1]: at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:842) 

<14>2015-02-10T12:59:09Z logspout dev_nginx_1[1]: 192.168.59.3 - - [10/Feb/2015:12:59:09 +0000] "POST /api/invoice/ HTTP/1.1" 500 1115 "http://192.168.59.103/"; "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.94 Safari/537.36" "-"

的消息文本中包含一行dev_nginx_1條目，它將n不屬於這裏。這應該被視爲一個單獨的事件。
每行包含前綴。 <14>2015-02-10T12:59:09Z logspout dev_zservice_1[1]:
每一行都有一個額外的新行

問題。爲什麼dev_nginx_1條目本身不是一個事件。爲什麼它被認爲屬於前一個？如何擺脫消息每一行中的系統日誌前綴。如何擺脫額外的新行？

來源

2015-02-10 Vadimo

至於（1），您在多行中使用了container_name。這是時間戳之後的字段。在你的例子中，他們都是「logspout」。對我來說似乎是對的。

至於（2），每一行都帶有前綴和時間戳，所以你會希望它們默認在那裏。您正在執行mutate{}以用log_message替換message，但我沒有看到您正在設置log_message。那麼，您如何看待前綴和時間戳被刪除？

來源

2015-02-10 23:48:08

對於（1），用%{SYSLOGHOST} %{DATA:container_name}（如您在grok中使用的）替換您的多線模式中的%{SYSLOGHOST:container_name} %{DATA}。

對於（2）和（3），你可以嘗試這樣的事：

mutate { 
    gsub => [ "message", "<\d+>.*?:\s", "", "message", "\n(\n)", "\1" ] 
}

這裏，gsub設置執行兩個操作：

檢查領域的「信息」，找到從「< 14>」的子字符串到一個冒號後跟一個空格，然後用空字符串替換那些子字符串。
檢查字段「消息」，找到由兩個連續的換行符組成的子字符串，並用一個換行符替換它們。它使用\1對組(\n)執行替代，因爲如果您嘗試使用\n本身，則Logstash實際上會將其替換爲\\n，這將不起作用。

來源

2016-12-08 22:01:20 LeilaHC

Logstash多行與系統日誌

回答

相關問題