Мне нужно определить шаблон Grok Grok для веб-сферы ниже журнала - PullRequest
Новая
       88

Мне нужно определить шаблон Grok Grok для веб-сферы ниже журнала

0 голосов
/ 27 января 2020

Пожалуйста, помогите мне создать шаблон Grok для журнала ниже: 

{ "sysdate":"[08/Jun/2019:00:00:12 -0400]", "site":"abcd.net", "host":"hostnam.net", "method":"POST", "request":"/services/path", "querystring":"", "port":"4123", "username":"-", "cookie":"0000k1cgki:1f:1bv8tat", "coauthsessionid":"-", "clienthost":"44.25.14.241", "httpversion":"HTTP/1.1", "useragent":"-", "referer":"-", "responsestatus":"200", "subresponse":"0", "win32status":"0", "sbytes":"799", "cbytes":"0", "timetaken":"3595" }

1 Ответ

1 голос
/ 27 января 2020

Попробуйте:

ВХОД: 

{"sysdate":"[08/Jun/2019:00:00:12 -0400]","site":"abcd.net","host":"hostnam.net", "method":"POST", "request":"/services/path", "querystring":"", "port":"4123", "username":"-", "cookie":"0000k1cgki:1f:1bv8tat", "coauthsessionid":"-", "clienthost":"44.25.14.241", "httpversion":"HTTP/1.1", "useragent":"-", "referer":"-", "responsestatus":"200", "subresponse":"0", "win32status":"0", "sbytes":"799", "cbytes":"0", "timetaken":"3595"}

РИСУНОК GROK: 

\{"sysdate":"%{GREEDYDATA:sysdate}","site":"%{GREEDYDATA:site}","host":"%{GREEDYDATA:host}", "method":"%{GREEDYDATA:method}", "request":"%{GREEDYDATA:request}", "querystring":"%{GREEDYDATA:querystring}", "port":"%{GREEDYDATA:port}", "username":"%{GREEDYDATA:username}", "cookie":"%{GREEDYDATA:cookie}", "coauthsessionid":"%{GREEDYDATA:coauthsessionid}", "clienthost":"%{GREEDYDATA:clienthost}", "httpversion":"%{GREEDYDATA:httpversion}", "useragent":"%{GREEDYDATA:useragent}", "referer":"%{GREEDYDATA:referer}", "responsestatus":"%{GREEDYDATA:responsestatus}", "subresponse":"%{GREEDYDATA:subresponse}", "win32status":"%{GREEDYDATA:win32status}", "sbytes":"%{GREEDYDATA:sbytes}", "cbytes":"%{GREEDYDATA:cbytes}", "timetaken":"%{GREEDYDATA:timetaken}"\}

РЕЗУЛЬТАТ: 

{
  "sysdate": [
    [
      "[08/Jun/2019:00:00:12 -0400]"
    ]
  ],
  "site": [
    [
      "abcd.net"
    ]
  ],
  "host": [
    [
      "hostnam.net"
    ]
  ],
  "method": [
    [
      "POST"
    ]
  ],
  "request": [
    [
      "/services/path"
    ]
  ],
  "querystring": [
    [
      ""
    ]
  ],
  "port": [
    [
      "4123"
    ]
  ],
  "username": [
    [
      "-"
    ]
  ],
  "cookie": [
    [
      "0000k1cgki:1f:1bv8tat"
    ]
  ],
  "coauthsessionid": [
    [
      "-"
    ]
  ],
  "clienthost": [
    [
      "44.25.14.241"
    ]
  ],
  "httpversion": [
    [
      "HTTP/1.1"
    ]
  ],
  "useragent": [
    [
      "-"
    ]
  ],
  "referer": [
    [
      "-"
    ]
  ],
  "responsestatus": [
    [
      "200"
    ]
  ],
  "subresponse": [
    [
      "0"
    ]
  ],
  "win32status": [
    [
      "0"
    ]
  ],
  "sbytes": [
    [
      "799"
    ]
  ],
  "cbytes": [
    [
      "0"
    ]
  ],
  "timetaken": [
    [
      "3595"
    ]
  ]
}

Вы можете использовать this для написания грока.

...