LINUX.ORG.RU
ФорумAdmin

Ошибка при обработке лога. Logstash, grok

 , ,


0

1

Добрый день! Осваиваю ELK. Пытаюсь парсить лог с помощью Logstash и grok.

Конфиг логсташ:

input { stdin { } }

filter {
    grok {
      match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{SYSLOG5424SD}%{SPACE}%{LOGLEVEL:Log_level}%{SPACE}%{GREEDYDATA:Parameters}%{SPACE}\-%{SPACE}\[operation=%{WORD:operation},%{SPACE}duration=%{NUMBER:duration}%{SPACE}sec\]%{SPACE}%{GREEDYDATA:Parameters}%{SPACE}%{GREEDYDATA:Parameters}%{SPACE}%{GREEDYDATA:Parameters}\[caller:%{SPACE}%{IPV4:caller},%{SPACE}username:%{SPACE}%{WORD:username}\]%{SPACE}%{GREEDYDATA:Parameters}%{SPACE}%{GREEDYDATA:Parameters}%{SPACE}%{GREEDYDATA:Parameters}%{SPACE}Payload:%{SPACE}{%{SPACE}%{GREEDYDATA:Payload}%{SPACE}}(?m)%{GREEDYDATA:java_state_trace}" }
    }
}

output {
  file {
   path => ["/tmp/test_log/output/output.log"]
   codec => rubydebug
 }
}

Лог:

2022-03-28 01:19:58,178 [default task-5117] INFO  LoggingFeature_LONGOPS - [operation=getClientStatus, duration=14.90 sec] REQ_IN
    ID: 304711
    Address: http://192.168.0.1:8080/test/test/services/getClientStatus [caller: 192.168.0.1, username: TEST_TEST]
    HttpMethod: POST
    Content-Type: application/json
    Headers: {Authorization=********, Accept=application/json, text/plain, */*, User-Agent=axios/0.21.4, connection=close, content-type=application/json, Host=192.168.0.1:8080, Conten$
    Payload:
{"data1":"7777777777","data2":1111}

Cpu usage (90 samples by 100 ms, total 9 sec):
java.lang.Thread.run (90) - 100%
 org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run (90) - 100%
  org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask (90) - 100%

На grokdebug.herokuapp.com выдаёт нормальный ответ со всеми требуемыми данными, а непосредственно в Logstash:

{
     "operation" => "getClientStatus",
          "host" => "test",
     "Log_level" => "INFO",
    "@timestamp" => 2022-03-30T08:49:35.228Z,
    "Parameters" => "LoggingFeature_LONGOPS ",
      "duration" => "14.90",
     "timestamp" => "2022-03-28 01:19:58,178",
       "message" => "2022-03-28 01:19:58,178 [default task-5117] INFO  LoggingFeature_LONGOPS - [operation=getClientStatus, duration=14.90 sec] REQ_IN",
      "@version" => "1"
}
{
    "@timestamp" => 2022-03-30T08:49:35.231Z,
          "tags" => [
        [0] "_grokparsefailure"
    ],
          "host" => "test",
       "message" => "    ID: 304711",
      "@version" => "1"
}

Подскажите, пожалуйста, что я делаю не так?


Для того чтобы оставить комментарий войдите или зарегистрируйтесь.