centos6.5:/root/sbin#cat -n vv
1 192.168.11.186,192.168.11.187 35199,3306 Dec 7, 2016 11:40:02.750520978 SELECT
2 r.trx_id waiting_trx_id,\x0a r.trx_mysql_thread_id waiting_thread,\x0a r.trx_query waiting_query,\x0a b.trx_id blocking_trx_id,\x0a b.trx_mysql_thread_id blocking_thread,\x0a b.trx_query blocking_query\x0aFROM\x0a information_schema.innodb_lock_waits w\x0a INNER JOIN\x0a information_schema.innodb_trx b ON b.trx_id = w.blocking_trx_id\x0a INNER JOIN\x0a information_schema.innodb_trx r ON r.trx_id = w.requesting_trx_id
此时分为2行
%{IPORHOST:clientip},%{IPORHOST:serverip}\s+(?<client_port>\S+),(?<server_port>\S+)\s+(?<time>(\S+\s+).*?[0-9]{2}:[0-9]{2}:[0-9]{2}\.\d+)\s+(?<running_sql>(\S+\s+).*)
{
"clientip": [
[
"192.168.11.186"
]
],
"serverip": [
[
"192.168.11.187"
]
],
"client_port": [
[
"35199"
]
],
"server_port": [
[
"3306"
]
],
"time": [
[
"Dec 7, 2016 11:40:02.750520978"
]
],
"running_sql": [
[
"SELECT \n r.trx_id waiting_trx_id,\\x0a r.trx_mysql_thread_id waiting_thread,\\x0a r.trx_query waiting_query,\\x0a b.trx_id blocking_trx_id,\\x0a b.trx_mysql_thread_id blocking_thread,\\x0a b.trx_query blocking_query\\x0aFROM\\x0a information_schema.innodb_lock_waits w\\x0a INNER JOIN\\x0a information_schema.innodb_trx b ON b.trx_id = w.blocking_trx_id\\x0a INNER JOIN\\x0a information_schema.innodb_trx r ON r.trx_id = w.requesting_trx_id"
]
]
}
此时可以玩转匹配
/*************
centos6.5:/root/sbin#cat -n dd
1 192.168.11.186,192.168.11.187 35199,3306 Dec 7, 2016 11:40:02.750520978 SELECT
2 r.trx_id waiting_trx_id,\x0a r.trx_mysql_thread_id waiting_thread,\x0a r.trx_query waiting_query,\x0a b.trx_id blocking_trx_id,\x0a b.trx_mysql_thread_id blocking_thread,\x0a b.trx_query blocking_query\x0aFROM\x0a
3 information_schema.innodb_lock_waits w\x0a INNER JOIN\x0a information_schema.innodb_trx b ON b.trx_id = w.blocking_trx_id\x0a INNER JOIN\x0a information_schema.innodb_trx r ON r.trx_id = w.requesting_trx_id
换成3行
此时
{
"clientip": [
[
"192.168.11.186"
]
],
"serverip": [
[
"192.168.11.187"
]
],
"client_port": [
[
"35199"
]
],
"server_port": [
[
"3306"
]
],
"time": [
[
"Dec 7, 2016 11:40:02.750520978"
]
],
"running_sql": [
[
"SELECT \n r.trx_id waiting_trx_id,\\x0a r.trx_mysql_thread_id waiting_thread,\\x0a r.trx_query waiting_query,\\x0a b.trx_id blocking_trx_id,\\x0a b.trx_mysql_thread_id blocking_thread,\\x0a b.trx_query blocking_query\\x0aFROM\\x0a "
]
]
}
匹配不完整了
需要
(?m)%{IPORHOST:clientip},%{IPORHOST:serverip}\s+(?<client_port>\S+),(?<server_port>\S+)\s+(?<time>(\S+\s+).*?[0-9]{2}:[0-9]{2}:[0-9]{2}\.\d+)\s+(?<running_sql>(\S+\s+).*)
在和 codec/multiline 搭配使用的时候,需要注意一个问题,
grok 正则和普通正则一样,默认是不支持匹配回车换行的。
就像你需要 =~ //m 一样也需要单独指定,具体写法是在表达式开始位置加 (?m) 标记。如下所示:
转载于:https://www.cnblogs.com/zhaoyangjian724/p/6198935.html