多行編解碼器錯誤？

Question

當我解析多行編解碼器的TIMESTAMP字段上的日誌時，它顯示方括號中的TIMESTAMP字段的錯誤輸出。

配置：

input { 
    file { 
    path => "D:\logstash\logstash-2.4.0\bin\slowlogs.txt" 
    start_position => "beginning" 
    codec => multiline { 
     pattern => "^%{TIMESTAMP_ISO8601} " 
     negate => true 
     what => previous 
    } 
    } 
} 

output { 
    stdout { codec => rubydebug } 
} 

日誌：

[2015-08-24 11:49:14,389] [INFO ][env      ] [Letha] using [1] data paths, mounts [[/ 
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs] 
[2015-08-24 11:49:14,389] [INFO ][env      ] [Letha] using [1] data paths, mounts [[/ 
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs] 
[2015-08-24 11:49:14,389] [INFO ][env      ] [Letha] using [1] data paths, mounts [[/ 
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs] 

輸出：

{ 
    "@timestamp" => "2017-05-23T11:19:10.635Z", 
     "message" => "[2015-08-24 11:49:14,389] [INFO ][env 
] [Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [ 
34.5gb], net total_space [118.9gb], types [hfs]\r\n[2015-08-24 11:49:14,389] [IN 
FO ][env      ] [Letha] using [1] data paths, mounts [[/\r\n(/de 
v/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs]\r\ 
n[2015-08-24 11:49:14,389] [INFO ][env      ] [Letha] using [1] 
data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [34.5gb], net total_s 
pace [118.9gb], types [hfs]\r\n\r\n\r", 
     "@version" => "1", 
      "tags" => [ 
     [0] "multiline" 
    ], 
      "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt", 
      "host" => "PC326815" 
} 

同樣日誌從[]

2015-08-24 11:49:14,389 [INFO ][env      ] [Letha] using [1] data paths, mounts [[/ 
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs] 
2015-08-24 11:49:14,389 [INFO ][env      ] [Letha] using [1] data paths, mounts [[/ 
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs] 
2015-08-24 11:49:14,389 [INFO ][env      ] [Letha] using [1] data paths, mounts [[/ 
(/dev/disk1)]], net usable_space [34.5gb], net total_space [118.9gb], types [hfs] 

除去它3210

執行相同的配置得到了這樣的輸出：

{ 
    "@timestamp" => "2017-05-23T11:25:48.075Z", 
     "message" => "2015-08-24 11:49:14,389 [INFO ][env      ] 
[Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [3 
.5gb], net total_space [118.9gb], types [hfs]\r", 
     "@version" => "1", 
      "tags" => [ 
     [0] "multiline" 
    ], 
      "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt", 
      "host" => "PC326815" 
} 
{ 
    "@timestamp" => "2017-05-23T11:25:48.278Z", 
     "message" => "2015-08-24 11:49:14,389 [INFO ][env      ] 
[Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [3 
.5gb], net total_space [118.9gb], types [hfs]\r", 
     "@version" => "1", 
      "tags" => [ 
     [0] "multiline" 
    ], 
      "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt", 
      "host" => "PC326815" 
} 
←[33mSIGINT received. Shutting down the agent. {:level=>:warn}←[0m 
stopping pipeline {:id=>"main"} 
{ 
    "@timestamp" => "2017-05-23T11:25:57.421Z", 
     "message" => "2015-08-24 11:49:14,389 [INFO ][env      ] 
[Letha] using [1] data paths, mounts [[/\r\n(/dev/disk1)]], net usable_space [3 
.5gb], net total_space [118.9gb], types [hfs]\r\n\r\n\r", 
     "@version" => "1", 
      "tags" => [ 
     [0] "multiline" 
    ], 
      "path" => "D:\\logstash\\logstash-2.4.0\\bin\\slowlogs.txt", 
      "host" => "PC326815" 
} 

這是給我正確的輸出。如何，我可以實現在括號[]中的時間戳字段相同。

我還通過賦予圖案=>"^\[%{TIMESTAMP_ISO8601}\] " THANKS

Answer 1

問題是與我在輸入曾提到多模式嘗試過。它必須這樣：

input { 
    file { 
    path => "D:\logstash\logstash-2.4.0\bin\slowlogs.txt" 
    start_position => "beginning" 
    codec => multiline { 
     pattern => "^\[%{TIMESTAMP_ISO8601:TIMESTAMP}\]" 
     negate => true 
     what => previous 
    } 
    } 
} 

output { 
    stdout { codec => rubydebug } 
}