![如何使用多行消息扩展字段](https://linux22.com/image/665049/%E5%A6%82%E4%BD%95%E4%BD%BF%E7%94%A8%E5%A4%9A%E8%A1%8C%E6%B6%88%E6%81%AF%E6%89%A9%E5%B1%95%E5%AD%97%E6%AE%B5.png)
我有一个像这样的 logstash 配置:
input {
lumberjack {
port => 5000
type => "logs"
ssl_certificate => "/path/to/mycert"
ssl_key => "/path/to/mykey"
}
}
filter {
if [type] == "logs" {
if [message] =~ /^\d\d\d\d/ {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE:other_field} %{GREEDYDATA:content}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
}
multiline {
pattern => "^\d\d\d\d"
what => "previous"
negate => true
}
}
}
output {
elasticsearch { host => localhost }
}
以下是一个示例日志:
2015-04-09T04:56:37.548Z OtherField Send message:
Keepalive {
Type: keepalive
key: ABCDE
time Thu Apr 09 00:56:37 EDT 2015
}
内容字段以字符串“发送消息:\n”结尾,没有其他内容。我们希望内容字段扩展并包含:“发送消息:\nKeepalive {\n 类型:keepalive\n 键:ABCDE\n 时间 Thu Apr 09 00:56:37 EDT 2015\n}”
我曾尝试使用add_field
,但我甚至无法说服它添加一个简单的字段(即"multilinemsg", "true"
),更不用说扩展内容字段了。
任何帮助,将不胜感激!