readMultiLIne是一个多行日志解析工具,能够将一个多行的输入日志Record分解为多个输出Records,一行日志对应一个Record。
readMultiLine还可以依据正则表达式(regex)匹配的结果,将输入Record中的多行符合regex匹配规则的日志合并为一个Record。readMultiLine的输出为一个“message”标记的字串串。
readMultiLine支持regex、what和negate参数,regex参数定义了输入Record中日志的开始行和需要合并的行,本文以regex参数为例,介绍readMultiLine的用法,其他参数采用默认设置。
在Morphline配置文件中,readMultiLine的参数定义如下
morphlines: [
{
id: morphline1
importCommands : ["org.kitesdk.**", "com.stratio.morphlines.**"]
commands: [
{
# parse log with stack traces
readMultiLine {
regex : "(^.<strong>+Exception</strong>: .+)|(^\\s+<strong>at </strong>.+)|(^\\s+\\.\\.\\. \\d+ more)|(^\\s*<strong>Caused by</strong>:.+)"
what : previous
charset : UTF-8
}
# parse sessions; begin new record when we find a line that starts with "Started session"
readMultiLine {
regex : "<strong>Started session.*</strong>"
what : next
charset : UTF-8
}
}
{ logInfo { format : "Output record: {}", args : ["@{}"] } }
]
}
]
针对一个多行日志
{message = [messge0 - I am in Line 1 of the Record 0 \n” +
“at feild 0 -- Warning Message described in Line 2 of Record 0 \n” +
"Started session. messge1 - I am a line (Line3) a new Record 1”]}
Morphlne输入2个Records:
Record 0: {message = [messge0 - I am in Line 1 of the Record 0 \n at feild 0 -- Warning Message described in Line 2 of Record 0]}
Record 1: {message = [
Started session. messge1 - I am a line (Line3) a new Record 1]}
其他参数的介绍参考http://kitesdk.org/docs/1.1.0/morphlines/morphlines-reference-guide.html#readMultiLine