我的邮件是这样的,在收件人、主题和邮件之间有制表符,但由于某种原因,它无法解析邮件的最后一个字段:
2020-07-20T03:33:01+00:00 webserver.sys.com TO=admin@test.com SUBJECT=[NOTICE WARNING] NOTICE: Grouping OK on 035750695894 MESSAGE=Log statistics; processed='destination(d_spol)=0', processed='src.internal(s_sys#2)=123012', stamp='src.internal(s_sys#2)=1595217005', processed='destination(d_mlal)=0'
我尝试在https://grokdebug.herokuapp.com/上使用grok过滤器,但它无法解析‘MESSAGE’的最后一个字段:
^%{TIMESTAMP_ISO8601:timestamp8601} %{DATA:host} TO=%{DATA:to} SUBJECT=%{DATA:subject} MESSAGE=%{DATA:msg}
以下是https://grokdebug.herokuapp.com/的输出,其中它与‘MESSAGE’不匹配:
{
"timestamp8601": [
[
"2020-07-20T03:33:01+00:00"
]
],
"YEAR": [
[
"2020"
]
],
"MONTHNUM": [
[
"07"
]
],
"MONTHDAY": [
[
"20"
]
],
"HOUR": [
[
"03",
"00"
]
],
"MINUTE": [
[
"33",
"00"
]
],
"SECOND": [
[
"01"
]
],
"ISO8601_TIMEZONE": [
[
"+00:00"
]
],
"host": [
[
"webserver.sys.com "
]
],
"to": [
[
"admin@test.com"
]
],
"subject": [
[
"[NOTICE WARNING] NOTICE: Grouping OK on 035750695894 "
]
],
"msg": [
[
""
]
]
}
发布于 2020-07-22 00:23:46
由于消息的其余部分被解析为最后一个字段,因此我只能使用GREEDYDATA:
^%{TIMESTAMP_ISO8601:timestamp8601} %{DATA:host} TO=%{DATA:to} SUBJECT=%{DATA:subject} MESSAGE=%{GREEDYDATA:msg}
https://stackoverflow.com/questions/63005327
复制相似问题