使用grok解析日志文件

try {
            File file = new File("C:\\Users\\Administrator\\Desktop\\220301.log") ;
            //创建对象集合，存储需要解析保存的字段
            ArrayList<LogAnalysis> list = new ArrayList<>();
            //构造一个BufferedReader类来读取文件
            BufferedReader br = new BufferedReader(new FileReader(file));
            String str = null;
            while((str = br.readLine())!=null){
                //使用readLine方法，一次读一行
                if (str.contains("POST /api/") || str.contains("GET /api/"))
                {
                    GrokCompiler grokCompiler = GrokCompiler.newInstance();
                    // 进行注册, registerDefaultPatterns()方法注册的是Grok内置的patterns
                    grokCompiler.registerDefaultPatterns();
                    /*
                     传入自定义的pattern, 会从已注册的patterns里面进行配对, 例如: TIMESTAMP_ISO8601:date, TIMESTAMP_ISO8601在注册的
                     patterns里面有对应的解析格式, 配对成功后, 会在match时按照固定的解析格式将解析结果存入map中, 此处date作为输出的key
                      */
                    Grok grok = grokCompiler.compile("%{TIMESTAMP_ISO8601:date}%{SPACE}%{IP:sIp}%{SPACE}%{WORD:method}" +
                            "%{SPACE}%{URIPATH:path}%{SPACE}%{GREEDYDATA:param}%{SPACE}%{INT:port}%{SPACE}%{IP:cIp}%{SPACE}%{URI:url}"+
                            "%{SPACE}%{INT:state}%{SPACE}%{WORD:times}");

                    // 通过match()方法进行匹配, 对log进行解析, 按照指定的格式进行输出
                    Match grokMatch = grok.match(str);
                    // 获取结果
                    Map<String, Object> resultMap = grokMatch.capture();
                    String[] paths = resultMap.get("path").toString().split("/");
                    //IIS存储为UTC日期,需要转换为本地日期存储
                    Date date = LocalDateUtils.utcToLocal(resultMap.get("date").toString());
                    LogAnalysis logAnalysis = new LogAnalysis(date,resultMap.get("sIp").toString(),resultMap.get("cIp").toString(),
                            resultMap.get("method").toString(),resultMap.get("state").toString(),resultMap.get("path").toString(),
                            paths[paths.length-1],resultMap.get("times").toString());
                    list.add(logAnalysis);
                }
            }
            result=list.size()+":"+sum;
        }catch (Exception e){
            logger.error("日志同步服务出现异常",e);
        }```

[grok语法定义](https://blog.csdn.net/weixin_30610755/article/details/101791242?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522164637232116780269843622%2522%252C%2522scm%2522%253A%252220140713.130102334..%2522%257D&request_id=164637232116780269843622&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~all~sobaiduend~default-2-101791242.es_vector_control_group&utm_term=grok&spm=1018.2226.3001.4187)