案例一
1.1 日志
Aug 6 2011 20:34:46 HUAWEI %% 01 HWCM/5/EXIT(l)[1]: exit from configure mode
Jan 8 2013 03:58:15+07:00 HUAWEI %% 01 HWCM/5/EXIT(l)[1]: exit from configure mode
1.2 日志grok解析
(?<ss1_date>(%{MONTH} %{MONTHDAY} %{YEAR} %{TIME}) | (%{MONTH} %{MONTHDAY} %{YEAR} %{TIME}%{ISO8601_TIMEZONE})) %{WORD:ss2_word} (?<ss3_cut_str>([\s\S]{2})) %{NUMBER:ss4_number} %{USERNAME:ss5_username}/%{NUMBER:ss6_number}/
1.3 解析结果
{
"ss6_number": "5",
"ss3_cut_str": "%%",
"ss4_number": "01",
"ss1_date": "Jan 8 2013 03:58:15+07:00",
"ss5_username": "HWCM",
"ss2_word": "HUAWEI"
}
1.4 必要说明
\s 空白符
\S 非空白符
[\s\S] 任意字符
[\s\S]* 0个到任意多个字符
[\s\S]*? 0个字符,匹配任何字符前的位置
\w 匹配包括下划线的任何单词字符。等价于[A-Za-z0-9_]
\W 匹配任何非单词字符。等价于[^A-Za-z0-9_]
截取字符串的前两位 (?<ss3_cut_str>([\s\S]{2}))
案例二
2.1 日志
2011-08-18 18:08:56 HUAWEI %%01CLI/5/LOGIN(l):CID=2160731923;VTY0 login from 192.168.0.1 succeed.
2.2 日志grok解析
(?<ss1_date>(%{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY})\s+%{TIME}) %{WORD:ss2_word} (?<ss3>([\s\S]{2}))(?<ss4>([\s\S]{2}))%{USERNAME:ss5_username}/%{NUMBER:ss6_number}/
2.3 解析结果
{
"ss6_number": "5",
"ss3": "%%",
"ss4": "01",
"ss1_date": "2011-08-18 18:08:56",
"ss5_username": "CLI",
"ss2_word": "HUAWEI"
}
案例三
3.1 日志
vclound 2015-11-03 03:35:50.283 INFO /usr/lib/python2.6/site-packages/urllib3/connectionpool.py:203 _new_conn - 140192616544000= Starting new HTTP connection (1): 240.10.129.80
3.2 日志grok解析
%{WORD:ss1_word} %{TIMESTAMP_ISO8601:ss2_stamp_time} %{LOGLEVEL:ss3_loglevel} %{PROG:ss4_filepath}:%{NUMBER:ss5_number} %{USERNAME:ss6_username} %{USERNAME:ss7_word} %{NUMBER:ss8_number}= (?<ss9>(.*)): %{IPORHOST:ss10_ip}
3.3 解析结果
{
"ss2_stamp_time": "2015-11-03 03:35:50.283",
"ss4_filepath": "/usr/lib/python2.6/site-packages/urllib3/connectionpool.py",
"ss6_username": "_new_conn",
"ss3_loglevel": "INFO",
"ss5_number": "203",
"ss7_word": "-",
"ss10_ip": "240.10.129.80",
"ss8_number": "140192616544000",
"ss9": "Starting new HTTP connection (1)",
"ss1_word": "vclound"
}
grok截取指定字符
参考:https://blog.csdn.net/cai750415222/article/details/86614854
表达式:(?<temMsg>(.*)(?=Report)/?) 获取Report之前的字符
表达式:(?<temMsg>(?=Report)(.*)/?) 获取包含Report及之后的字符
表达式:(?<temMsg>(.*)(?<=Report)/?) 获取不含Report及之后的字符
表达式:(?=Report)中的等于【=】符号如果换成【<=】表示不包含本身
表达式:(?<temMsg>(?<=Report).*?(?=msg)) 截取Report和msg之间的值 不包含Report和msg本身
表达式:(?<temMsg>(Report).*?(?=msg)) 截取包含Report但不包含msg
表达式:(?<temMsg>(?<=Report).*?(msg))截取不包含Report但包含msg
表达式:(?<temMsg>(Report).*?(msg|request))输出以Report开头,以msg或者以request结尾的所有包含头尾信息
表达式:(?<temMsg>(Report).*?(?=(msg|request)))输出以Report开头,以msg或者以request结尾的不包含头尾信息
如果是单个字符串(Report).*?(?=msg) 可以写成Report.*?(?=msg)
表达式:(?<file>([\s\S]{50})) 截取日志前50个字符,作为file的值