![为什么 logstash syslog_pri 过滤器无法看到系统日志消息中的优先级](https://linux22.com/image/670713/%E4%B8%BA%E4%BB%80%E4%B9%88%20logstash%20syslog_pri%20%E8%BF%87%E6%BB%A4%E5%99%A8%E6%97%A0%E6%B3%95%E7%9C%8B%E5%88%B0%E7%B3%BB%E7%BB%9F%E6%97%A5%E5%BF%97%E6%B6%88%E6%81%AF%E4%B8%AD%E7%9A%84%E4%BC%98%E5%85%88%E7%BA%A7.png)
我正在运行 LS 2.0.0,我注意到一个问题,即 syslog_pri 过滤器无法检测系统日志开始时的优先级。我的过滤器配置如下:
filter {
if [type] == "relp" {
syslog_pri { }
grok {
match => { "message" => "%{SYSLOG5424PRI}(?:%{POSINT} |-)+(?:%{TIMESTAMP_ISO8601:syslog5424_ts}|-) +(?:%{HOSTNAME:syslog5424_host}|-) +(-|%{SYSLOG5424PRINTASCII:syslog5424_app}) +%{GREEDYDATA:syslog5424_msg}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{syslog5424_host}" ]
tag_on_failure => "gpf_relp"
}
date {
match => [ "syslog5424_ts", "ISO8601" ]
}
}
}
这应该能够从以下日志中提取 PRI,但它失败了,并且恢复为所有消息的默认 (13) 优先级:
{
"_index": "logstash-2015.11.10",
"_type": "relp",
"_id": "AVDxXHq4lzuNTbjDHPbE",
"_score": null,
"_source": {
"message": "<86>1 2015-11-10T12:26:20.429088+00:00 integration-gw3 sshd 2587 - - pam_unix(sshd:session): session closed for user sftpuser\n",
"@version": "1",
"@timestamp": "2015-11-10T12:26:20.429Z",
"type": "relp",
"host": "10.10.11.23:39532",
"syslog_severity_code": 5,
"syslog_facility_code": 1,
"syslog_facility": "user-level",
"syslog_severity": "notice",
"syslog5424_pri": "86",
"syslog5424_ts": "2015-11-10T12:26:20.429088+00:00",
"syslog5424_host": "integration-gw3",
"syslog5424_app": "sshd",
"syslog5424_msg": "2587 - - pam_unix(sshd:session): session closed for user sftpuser\n",
"received_at": "2015-11-10T12:26:20.430Z",
"received_from": "integration-gw3"
},
"fields": {
"@timestamp": [
1447158380429
]
},
"sort": [
1447158380429
]
}
如您所见,PRI 设置为 86,并且我的 grok 过滤器会选择它,但是 syslog_pri 不会更改这些默认值:
"syslog_facility": "user-level",
"syslog_severity": "notice",
有人能指出我做错了什么吗?
答案1
在看着文档对于syslog_pri
过滤器,它似乎正在寻找名为的字段中的优先级syslog_pri
,而不是原始消息。
鉴于您在 groning 该行之前运行该过滤器,它在该字段中没有任何内容,因此返回优先级 13(user.notice),如上面的文档所述。
为了让它按你想要的方式工作,你需要移动syslog_pri
过滤器后grok 并将其更改为:
syslog_pri {
syslog_pri_field_name => "syslog5424_pri"
}