Fluentd Regex Mismatch - PullRequest
Новая
       30

Fluentd Regex Mismatch

0 голосов
/ 04 ноября 2019

Fluentd не может разобрать регулярное выражение. Как я могу отладить проблему?

Я проверил регулярное выражение, используя https://fluentular.herokuapp.com/,, оно проверено и работает.

Свободная конфигурация выглядит следующим образом - 

    <source>
      @id haproxy
      @type syslog
      port 5140
      bind 0.0.0.0
      tag haproxy
      <parse>
        @type multi_format
        <pattern>
          format regexp 
          expression /^\<(?<pri>[0-9]{1,3})\>(?<syslogTime>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[^ :\[]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? (?<remoteAddress>[-\w\.]+:\d+) \[(?<requestDate>[^\]]*)\] (?<frontend>[-\w]+) (?<namespace>[-\w]+)-(?<service>[-\w]+)-(?<serviceTargetPort>[\d]+)?\/[-\w]+ (?<requestReadTime>\d+)\/(?<waitTime>\d+)\/(?<backendConnectTime>\d+)\/(?<backendResponseTime>\d+)\/(?<responseTime>\d+) (?<statusCode>\d+) (?<responseBytes>\d+) (?<reqCookie>[-\w]+) (?<resCookie>[-\w]+) (?<terminationState>[-\w]+) (?<actconn>\d+)\/(?<feconn>\d+)\/(?<beconn>\d+)\/(?<srvconn>\d+)\/(?<retries>\d+) (?<srvqueue>\d+)\/(?<backendQueue>\d+) "(?<method>[A-Z]+) (?<url>[^ ]+) (?<httpVersion>[^ ]+)"$/
          </pattern>
        <pattern>
          format regexp
          expression /^\<(?<pri>[0-9]{1,3})\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[^ :\[]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? Connect from (?<remoteAddress>[\w\.]+:\d+) to (?<backendAddress>[\w\.]+:\d+) \((?<frontend>[\w]+)\/(?<mode>[\w]+)\)$/
        </pattern>
        <pattern>
          format regexp
          expression /^\<(?<pri>[0-9]{1,3})\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[^ :\[]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? Server (?<namespace>ops-system|[\w]+)-(?<service>[-\w]+)\/[-\w]+ is going DOWN for maintenance. (?<remainingActive>\d+) active and (?         <remainingBackup>\d+) backup servers left. (?<activeSessions>\d+) sessions active, (?<requeued>\d+) requeued, (?<remainingInQueue>\d+) remaining in queue.$/
        </pattern>
        <pattern>
          format regexp
          expression /^\<(?<pri>[0-9]{1,3})\>(?<time>[^ ]* {1,2}[^ ]* [^ ]*) (?<ident>[^ :\[]*)(?:\[(?<pid>[0-9]+)\])?(?:[^\:]*\:)? Server (?<namespace>ops-system|[\w]+)-(?<service>[\w-]+)\/[\w-]+ is (?<status>[\w]+), reason: (?<reason>[^,]+), (info: "(?<info>[^"]+)", )?   check duration: (?<checkDuration>[^.]+). (?<remainingActive>\d+) active and (?<remainingBackup>\d+) backup servers (left|online). ((?<activeSessions>\d+) sessions active, )?(?<requeued>\d+) (sessions )?requeued, (?<remainingInQueue>\d+) (remaining|total) in queue.$/
        </pattern>
      </parse>
    </source>

Я получаю ошибку - 

2019-11-04 17:03:42 +0000 [warn]: #0 [haproxy] failed to parse message data="<142>Nov  4 17:03:42 haproxy[116]: 172.27.0.0:16798 [04/Nov/2019:17:03:42.558] http default-app2-8080/SRV_sKdQm 0/0/0/0/0 200 111 - - ---- 1/1/0/0/0 0/0 \"HEAD /ss HTTP/1.1\""
2019-11-04 17:06:07 +0000 [warn]: #0 [haproxy] failed to parse message data="<142>Nov  4 17:06:07 haproxy[116]: 172.27.0.0:17684 [04/Nov/2019:17:06:07.435] http default-app2-8080/SRV_nI2xB 0/0/0/0/0 200 111 - - ---- 1/1/0/0/0 0/0 \"HEAD /ss HTTP/1.1\""
2019-11-04 17:06:08 +0000 [warn]: #0 [haproxy] failed to parse message data="<142>Nov  4 17:06:08 haproxy[116]: 172.27.0.0:17692 [04/Nov/2019:17:06:08.075] http default-app2-8080/SRV_sKdQm 0/0/0/0/0 200 111 - - ---- 1/1/0/0/0 0/0 \"HEAD /ss HTTP/1.1\""
...