当前位置：首页 > news >正文

filebeat收集不规则多行日志

news 2025/9/18 1:45:59

现环境有多行日志输出内容和格式不确定，合并后使用grok默认正则无法收集，需要自己编写正则
日志内容如下：

ERROR|2023-04-06 14:27:52|helper|test|http|/api/ad/listBanner|1d60fff861bqwe4b0397be554141eb 127.0.0.1|1b4429-5adb-44d4-acfe-0tee65eec19d|gw|Error: Class "HttpEncodingException" not found in /var/www/html/helper/59_20230406135132/app/Api/Controller/AdController.php:22
Stack trace:
#0 /var/www/html/helper/59_20230406135132/vendor/workerman/webman-framework/src/App.php(387): App\Api\Controller\AdController->listBanner()
#1 /var/www/html/helper/59_20230406135132/vendor/workerman/webman-framework/src/App.php(348): Webman\App::Webman\{closure}()
#2 /var/www/html/helper/59_20230406135132/common/Library/LogAccess/LogAccessMiddleware.php(40): Webman\App::Webman\{closure}()
#3 /var/www/html/helper/59_20230406135132/vendor/workerman/webman-framework/src/App.php(340): Common\Library\LogAccess\LogAccessMiddleware->process()
#4 /var/www/html/helper/59_20230406135132/vendor/workerman/webman-framework/src/App.php(167): Webman\App::Webman\{closure}()
#5 /var/www/html/helper/59_20230406135132/vendor/workerman/workerman/Connection/TcpConnection.php(646): Webman\App->onMessage()
#6 [internal function]: Workerman\Connection\TcpConnection->baseRead()
#7 /var/www/html/helper/59_20230406135132/vendor/workerman/workerman/Events/Event.php(193): EventBase->loop()
#8 /var/www/html/helper/59_20230406135132/vendor/workerman/workerman/Worker.php(1629): Workerman\Events\Event->loop()
#9 /var/www/html/helper/59_20230406135132/vendor/workerman/workerman/Worker.php(1423): Workerman\Worker::forkOneWorkerForLinux()
#10 /var/www/html/helper/59_20230406135132/vendor/workerman/workerman/Worker.php(1397): Workerman\Worker::forkWorkersForLinux()
#11 /var/www/html/helper/59_20230406135132/vendor/workerman/workerman/Worker.php(560): Workerman\Worker::forkWorkers()
#12 /var/www/html/helper/59_20230406135132/vendor/workerman/webman-framework/src/support/App.php(131): Workerman\Worker::runAll()
#13 /var/www/html/helper/59_20230406135132/start.php(4): support\App::run()
#14 {main}|[]

原先pipeline中grok的写法如下，并且已经在filebeat.yml将日志合并为单个事件，也无法在message中使用官方提供的GREEDYDATA匹配到多行日志，个人认为是日志中有大量的反斜杠'\'造成，反斜杠可能会被转义导致报错丢掉该条日志

        "grok" : {"field" : "message","patterns" : ["""%{DATA:level}\|%{DATA:logdate}\|%{DATA:app}\|%{DATA:env}\|%{DATA:type}\|%{DATA:site}\|%{DATA:device_id}\|%{DATA:request_id}\|%{DATA:from}\|%{GREEDYDATA:message}\|%{GREEDYDATA:context}"""]}

最后将message字段修改成如下内容可以进行正确匹配

%{DATA:level}\|%{DATA:logdate}\|%{DATA:app}\|%{DATA:env}\|%{DATA:type}\|%{DATA:site}\|%{DATA:device_id}\|%{DATA:request_id}\|%{DATA:from}\|(?<message>[^\|]+)\|%{GREEDYDATA:context}

查看全文

http://www.lryc.cn/news/58133.html