![处理多行日志条目(日志解析)](https://linux22.com/image/643728/%E5%A4%84%E7%90%86%E5%A4%9A%E8%A1%8C%E6%97%A5%E5%BF%97%E6%9D%A1%E7%9B%AE%EF%BC%88%E6%97%A5%E5%BF%97%E8%A7%A3%E6%9E%90%EF%BC%89.png)
假设你有类似这样的日志
Thu 2014-10-09 23:55:12: 01: Session 525229; child 0101
Thu 2014-10-09 23:55:12: 05: Accepting IMAP connection from [172.1.2.3:52337] to [1.2.3.4:143]
Thu 2014-10-09 23:55:12: 03: --> * OK bla.com IMAP4rev1 Mailserver 14.0.3 ready
Thu 2014-10-09 23:55:12: 02: <-- 1 capability
Thu 2014-10-09 23:55:12: 03: --> * CAPABILITY IMAP4rev1 NAMESPACE AUTH=LOGIN AUTH=PLAIN IDLE COMPRESS=DEFLATE ACL UNSELECT UIDPLUS QUOTA BINA
RY XLIST
Thu 2014-10-09 23:55:12: 03: --> 1 OK CAPABILITY completed
Thu 2014-10-09 23:55:12: 02: <-- 2 authenticate plain
Thu 2014-10-09 23:55:12: 03: --> +
Thu 2014-10-09 23:55:12: 02: <-- ******
Thu 2014-10-09 23:55:12: 01: Authenticated as [email protected]
我想做一些用户会计。
现在信息(会话号、IP 地址、用户名等)分布在多行上,如上所示。
如何将此类数据“转换”为 IP /用户对列表?
你可以做类似的事情grep -e ": Session" -e ": Accepting" -e ": Authenticated" logfile
这将给你
Thu 2014-10-09 23:55:12: 01: Session 525229; child 0101
Thu 2014-10-09 23:55:12: 05: Accepting IMAP connection from [172.1.2.3:52337] to [1.2.3.4:143]
Thu 2014-10-09 23:55:12: 01: Authenticated as [email protected]
Thu 2014-10-09 23:55:13: 01: Session 525230; child 0101
Thu 2014-10-09 23:55:13: 05: Accepting IMAP connection from [172.1.2.4:52537] to [1.2.3.4:143]
Thu 2014-10-09 23:55:13: 01: Authenticated as [email protected]
...
您将如何分离这些物品?
所有这一切都发生得非常不自然。
答案1
使用 LogStash,它原生支持多行条目。