LogStash 正则匹配

Question

日志格式

2015-09-28·09:50:48·[http-bio-80-exec-13]·DEBUG·com.weitoo.server.aspect.LogAspect·-{ip:183.16.4.40,url:http://api.xx.com/server/sc/commodity/getOnlineCommodity,param:{"shopId":1000001,"needCategory":false,"needCommodityTotal":false,"searchCommodityId":1002001},return:{"status":1},cost:3.911ms}

通过https://grokdebug.herokuapp.com/

匹配出:

time: 2015-09-28·09:50:48
level: DEBUG
class:com.weitoo.server.aspect.LogAspect
ip:183.16.4.40
path:http://api.xx.com/server/sc/commodity/getOnlineCommodity
param:{"shopId":1000001,"needCategory":false,"needCommodityTotal":false,"searchCommodityId":1002001}
return:{"status":1}
cost:3.911

本人也尝试研究了tomcat_log 的demo
https://github.com/logstash-plugins/logstash-patterns-core/blob/master/patterns/java
(没匹配出message)

以及自动生成grok表达式的网站
http://grokconstructor.appspot.com/ (有点小bug)

官网说明也看了

https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html
(只举了简单的正则)

均以失败告终，研究了好久了，望大侠指教啊~~

Answer 1

已经解决

SERVER_LOG %{DATA:year}-%{DATA:month}-%{DATA:day}\ %{DATA:hour}\:%{DATA:min}\:%{DATA:sec}\ %{DATA:level}\ %{DATA:class} -{ip:%{DATA:ip},url:%{DATA:url},param:%{DATA:param},return:%{DATA:return},cost:%{BASE10NUM:cost}

conf

input {
  file {
   type=>"xx_server_log"
   path=>"/opt/software/apache-tomcat-7.0.59/logs/catalina.out"
   codec=> multiline {
           pattern => "(^.+Exception:.+)|(^\s+at .+)|(^\s+... \d+ more)|(^\s*Caused by:.+)"
           what=> "previous"
    }

 }
}



filter {
        if [type] == "xx_server_log" {
           grok {
                 match => [ "message","%{SERVER_LOG}"]
                 patterns_dir => ["/opt/conf/logstash"]
                 remove_field => ["message"]
          }
        }
}


output {
   elasticsearch {
  host =>"xx-management"
  protocol =>"http"
  workers => 5
  template_overwrite => true

}
   stdout { codec=> rubydebug }
}