elk之 grok过滤参考文章

# 常用grok 内置正则中文解释

https://blog.csdn.net/weixin_30505043/article/details/96707797

 

# 调试网站  elki界面开发工具貌似也可以用  收藏夹里几篇文章讲的不错 不过学习还得靠自己动手才行 尤其是正则

http://grokdebug.herokuapp.com/?   

https://elasticsearch.cn/article/179

 # 可以安装的 docker  版本 grokdebug 调试工具

https://www.cnblogs.com/rongfengliang/p/12198738.html

 

推荐文章：https://blog.csdn.net/qq_36666651/article/details/83617858

input{
	stdin{}
}

filter{
# 参考https://blog.csdn.net/qq_36666651/article/details/83617858
#[2020-12-31 15:10:00.660][INFO][cn.com.xxx.mms.component.ons.producer.ONSProducerHandler]消息内容：TopicMessage{Properties:{KEYS=MessageKey}messageTag='insToSaaS', receiptHandle='null'}
mutate {
				# 替换掉开头的[
				gsub => ["message", "\[", ""]
				# 根据]分割字段
				split => ["message", "]"]

				add_field => { "log_time" => "%{[message][0]}"}
				add_field => { "level" => "%{[message][1]}"}
				add_field => { "app_name" => "%{[message][2]}"}
				add_field => { "mes" => "%{[message][3]}"}
				#add_field => { "class" => "%{[message][4]}"}
				#rename => ["host", "host_name"]
        }
}


output{
	stdout{}
}

input{
	stdin{}
}

filter{
#[2020-12-31 15:10:00.660][INFO][cn.com.hyundai.mms.component.ons.producer.ONSProducerHandler]消息内容：TopicMessage{Properties:{KEYS=MessageKey}messageTag='insToSaaS', receiptHandle='null'}
mutate {
				# 替换掉开头的[
				gsub => ["message", "\[", ""]
				# 根据]分割字段
				split => ["message", "]"]

				add_field => { "log_time" => "%{[message][0]}"}
				add_field => { "level" => "%{[message][1]}"}
				add_field => { "source_name" => "%{[message][2]}"}
				add_field => { "mes" => "%{[message][3]}"}
				#add_field => { "class" => "%{[message][4]}"}
				#rename => ["host", "host_name"]
        }
	kv {
			#include_keys => ["log_time", "level", "version", "source_name"]
				field_split => "="
		}

		mutate {
				replace => {"message" => "%{[message][4]}"}
		}
		
		# 提取年份 月份 日期
		grok {
			match => ["log_time", "(?<YYYY>\d{4})-(?<MM>\d{1,2})-(?<DD>\d{1,2})"]
		}
}


output{
	stdout{}
}