Logstash grok解析教程

举例操作如下：

列2：

2019-09-12 14:16:36.320+08:00 INFO f7-c78f-4f12-a0f1-83a2610b2dfc DispatcherConnector ip-192-168-114-244 [Mqtt-Device-1883-worker-18-1] com.ericsson.sep.dispatcher.api.transformer.v1.MessageTransformer {“TraceID”:”f7-c78f-4f12-a0f1-83a2610b2dfc”,”clientId”:”03466K4GA1059″,”username”:”LB37622Z3KX”} uplinkTransform|RVS|LB37622Z3KX|VDF|{“header”:{“requestid”:117,”timeStamp”:57,”eventId”:57,”creatorId”:0,”requestType”:0},”body”:{“serviceId”:51,”serviceData”:{“vehicleStatus”:{“basicVehicleStatus”:{“position”:{“latitude”:,”longitude”:,”altitude”:1019,”posCanBeTrusted”:true,”carLocatorStatUploadEn”:true,”marsCoordinates”:false},”speed”:745,”speedValidity”:0,”direction”:222,”engineStatus”:0,”engineBlockedStatus”:0,”distanceToEmpty”:393},”additionalVehicleStatus”:{“drivingSafetyStatus”:{“srsStatus”:0,”vehicleAlarm”:0,”doorOpenStatusDriver”:0,”doorOpenStatusPassenger”:0,”doorOpenStatusDriverRear”:0,”doorOpenStatusPassengerRear”:0,”doorLockStatusDriver”:0,”doorLockStatusPassenger”:0,”doorLockStatusDriverRear”:0,”doorLockStatusPassengerRear”:0,”trunkOpenStatus”:0,”trunkLockStatus”:0,”engineHoodOpenStatus”:0,”seatBeltStatusDriver”:false,”seatBeltStatusPassenger”:false,”electricParkBrakeStatus”:0,”electricParkBrakeStatusValidity”:0},”maintenanceStatus”:{“mainBatteryStatus”:{“stateOfCharge”:2,”voltage”:128},”tyreStatusDriver”:169,”tyreStatusPassenger”:169,”tyreStatusDriverRear”:166,”tyreStatusPassengerRear”:165,”tyrePreWarningDriver”:0,”tyrePreWarningPassenger”:0,”tyrePreWarningDriverRear”:0,”tyrePreWarningPassengerRear”:0,”distanceToService”:4516,”serviceWarningStatus”:0,”odometer”:4844},”runningStatus”:{“engineOilTemperature”:80,”engineOilPressureWarning”:0,”engineCoolantTemperature”:165,”engineCoolantTemperatureValidity”:0,”fuelLevel”:65,”aveFuelConsumption”:780,”avgSpeed”:37},”climateStatus”:{“winStatusDriver”:2,”winStatusDriverValidity”:1,”winStatusPassenger”:2,”winStatusPassengerValidity”:1,”winStatusDriverRear”:0,”winStatusDriverRearValidity”:0,”winStatusPassengerRear”:0,”winStatusPassengerRearValidity”Grok 教程;:0,”sunroofOpenStatus”:3,”ventilateStatus”:0,”winPosDriver”:0,”winPosPassenger”:0,”winPosDriverRear”:127,”winPosPassengerRear”:127,”sunroofOpenStatusValidity”:1,”exteriorTemp”:114,”exteriorTempValidity”:0,”preClimateActive”:true,”airCleanSts”:0,”winCloseReminder”:0,”drvHeatSts”:0,”passHeatingSts”:0,”rlHeatingSts”:0,”rrHeatingSts”:0,”drvVentSts”:0,”rrVentSts”:0},”drivingBehaviourStatus”:{“brakePedalDepressed”:false,”brakePedalDepressedValidity”:0,”engineSpeed”:6416,”engineSpeedValidity”:0,”transimissionGearPostion”:4,”cruiseControlStatus”:0},”carConfig”:{“heatedFrontSeats”:1,”parkingClimateLevel”:1,”heatedSteeringWheel”:1}},”temStatus”:{“vin”:”LB37622Z3KX”,”powerSource”:0,”backupBattery”:{“stateOfCharge”:4,”stateOfHealth”:0,”voltage”:4,”chargeLevel”:100},”powerMode”:0,”serviceProvisoned”:true,”healthStatus”:1,”diagnostics”:{“ecuID”:”T-BOX”,”diagnosticResult”:1,”dtcs”:[{“dtc”:””,”status”:{“code”:40}},{“dtc”:””,”status”:{“code”:46}},{“dtc”:””,”status”:{“code”:40}},{“dtc”:”940C13″,”status”:{“code”:40}}]},”networkAccessStatus”:{“simInfo”:{“msisdn”:””,”imsi”:”9817″,”iccId”:””},”mobileNetwork”:”4G”},”serialNumber”:”03466K4GA1059″,”completeECUPartNumbers”:””,”imei”:”9835″,”hwVersion”:”HW_REV_1.2″,”swVersion”:”NGT_TBOX_142B”}}}}}

grok调试如下：

%{TIMESTAMP_ISO8601:access_time}s*%{LOGLEVEL:level}s*%{UUID:uuid}s*%{WORD:word}s*%{HOSTNAME:hostname}s*[%{DATA:work}]s*(?

([S+]*))s*(?

([S+]*))s*%{GREEDYDATA:message_data}

 列3：

192.168.125.138 – – [12/Sep/2019:14:10:58 +0800] “GET /backend/services/ticketRemind/query?cid=&msgType=1&pageSize=100&pageIndex=1&langCode=zh HTTP/1.1” 200 91

grok调试如下：

 %{IP:ip}s*%{DATA:a}s*[%{HTTPDATE:access_time}]s*%{DATA:b}%{WORD:method}s*%{URIPATH:url}%{URIPARAM:param}s*%{URIPROTO:uri}%{DATA:c}%{NUMBER:treaty}%{DATA:d}s*%{NUMBER:status}s*%{NUMBER:latency_millis}