主页 / 问题 / 1561175
Accepted
Dmitriy P
Asked:2024-01-11 20:02:48 +0000 UTC2024-01-11 20:02:48 +0000 UTC

请帮我解析 GROK 的日志

  • 772

有一个日志

[2024-01-10 06:35:11.4292] [DEBUG] [] [GRT.ARM.Infrastructure.Integration.Services.TRE.TREListener] TREListener connected to https://GRT-srv1.test.lan:5800/ 
[2024-01-10 06:36:38.9158] [INFO] [] [GRT.ARM.Services.Implementations.Traffic.LaneController] LaneId: 2, Вызван метод [PlateScannedAsync]: [Номер: FG522EFD5, отправлен оператором - False.]. 
[2024-01-10 06:36:38.9158] [DEBUG] [] [GRT.ARM.Services.Implementations.Traffic.LaneController] LaneId: 2, Вызван метод [PlateScannedAsync]: [Номер получен от LPS.]. 
[2024-01-10 06:36:39.0443] [DEBUG] [] [GRT.ARM.Infrastructure.Storages.LicensePlateStorage] Adding LPS event for FG5224FD5 to storage. 
[2024-01-10 06:36:39.0443] [DEBUG] [] [GRT.ARM.Infrastructure.Storages.LicensePlateStorage] Taking LPS event for FG5224FD5 from storage. 
[2024-01-10 06:36:39.0999] [DEBUG] [] [GRT.ARM.Services.Notifications.ArmEventNotification.ArmEventNotificationHandler] Sending Arm Event, type: LicensePlateRecognized, Kafka ID: b19626e7-f8bb-49a4-a190-0be172af3733 
[2024-01-10 06:36:39.1482] [DEBUG] [] [GRT.ARM.Infrastructure.SignalR.Wrappers.PassageHubWrapper] LaneId: 2, отправлен сигнал SignalR из метода [NotifyOnPlateScannedAsync] с параметрами: [Number: FG5224FD5, RecognitionLevel: Accurate]. 
[2024-01-10 06:36:41.7794] [DEBUG] [] [GRT.ARM.Services.Implementations.Traffic.LaneController] LaneId: 2, Вызван метод [CarArrivedToEntranceZoneAsync].

请帮我解析 Grok 的日志。目前我只得到这个：

^\[%{TIMESTAMP_ISO8601:timestamp}\]\s+(\[%{WORD:loglevel}\]\s+)%{NOTSPACE}\s+\[%{DATA:field3}\]?%{GREEDYDATA:message}

我将不胜感激任何帮助。

elasticsearch

1 个回答

  1. Best Answer

    经过多次试验和错误，我得出的结论是每行都需要自己的过滤器，这已经完成了。为每行创建 12 个过滤器，所有内容都添加到 filter.conf 中，我得到了我想要的。所以问题已经结束了。

    • 0

相关问题