http://coding.dong.asia/tags/grok/ Recent content in Grok on Coding Hugo cn 京ICP备17034023号 © 2019 隨風揚 Tue, 05 Dec 2017 06:06:30 +0000 http://coding.dong.asia/elk/logstash/3/ Tue, 05 Dec 2017 06:06:30 +0000 http://coding.dong.asia/elk/logstash/3/ <p>logstash的异常信息并不像elastichsearch那样可以打印出详细的java堆栈错误，方便出错后排查问题。</p> <p>在使用logstash中遇到_grokparsefailure，实在是太难调试，只能一点点去试、去分析。</p> <p>之前在解析一个标准的syslog日志竟然也出错。用的官方的标准的pattern。</p> <p>下面这行日志grok解析失败了：</p> <p>从<a href="https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns">官方模版</a>中的正则可以看出对于HOSTNAME的解析不支持&quot;_&quot;;。</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">SYSLOGHOST %<span class="o">{</span>IPORHOST<span class="o">}</span> </span></span><span class="line"><span class="cl">IPORHOST <span class="o">(</span>?:%<span class="o">{</span>HOSTNAME<span class="o">}</span><span class="p">|</span>%<span class="o">{</span>IP<span class="o">})</span> </span></span><span class="line"><span class="cl">HOSTNAME <span class="se">\b</span><span class="o">(</span>?:<span class="o">[</span>0-9A-Za-z<span class="o">][</span>0-9A-Za-z-<span class="o">]{</span>0,62<span class="o">})(</span>?:<span class="se">\.</span><span class="o">(</span>?:<span class="o">[</span>0-9A-Za-z<span class="o">][</span>0-9A-Za-z-<span class="o">]{</span>0,62<span class="o">}))</span>*<span class="o">(</span><span class="se">\.</span>?<span class="p">|</span><span class="se">\b</span><span class="o">)</span> </span></span></code></pre></div><p>找到问题，解决就容易了，要么改主机名要么不用官方的pattern。</p>