日志格式是这样的:
2016-05-30 14:50:17.331 [pool-3-thread-41] INFO c.s.o.t.service.impl.sabr.SabrFetchInfPriceService - 【其他日志】【自动出票】订单号:jp14645897416599580,获取出票价格成功。 2016-05-30 14:50:17.807 [pool-3-thread-43] INFO c.s.o.t.service.impl.sabr.SabrFetchInfPriceService - 【其他日志】【自动出票】订单号:jp14645889843370139,获取出票价格返回的数据为:。 2016-05-30 14:50:17.816 [pool-3-thread-43] ERROR c.s.o.t.service.impl.sabr.SabrFetchInfPriceService - 处理【获取出票价格返回结果】时出错.
费劲了半天,写成这样,貌似解析出来了
input { beats { port => "5043" } } filter { grok { match => { "message" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:?%{MINUTE}(?::?%{SECOND}) (?<javaThread>\[.*?\]) %{LOGLEVEL:level}\s+%{JAVACLASS:class} - %{JAVALOGMESSAGE:logmessage}" } } } output { elasticsearch { hosts => [ "localhost:9200" ] } }
-------------------- https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/java 这里有一些内置的正则写法,但有些貌似不好使,自己试了半天。
|