HTTP 的 GROK 模式 URL

Question

正在尝试解析以下字符串

http://localhost:8080/client/session/login abc.xyz@yahoo.com backendorg 具有以下 GROK 模式

%{URIPATHPARAM:url}%{SPACE}%{EMAILADDRESS:email}%{SPACE}%{USERNAME:org} 未完成 url.

{
  "org": "backendorg",
  "url": "//localhost:8080/client/session/login",
  "email": "abc.xyz@zinier.com"
}```
  Anyone could suggest how to get complete URL.

Answer 1

使用URI代替URIPATHPARAM，像这样：%{URI:url}%{SPACE}%{EMAILADDRESS:email}%{SPACE}%{USERNAME:org}

Answer 2

GROK 模式：

%{URI:url}%{SPACE}(?<email>[a-zA-Z0-9_.+=:-]+@[0-9A-Za-z][0-9A-Za-z-]{0,62}(?:\.(?:[0-9A-Za-z][0-‌9A-Za-z-]{0,62}))*)%{SPACE}%{USERNAME:org}

输出：

{
  "url": [
    [
      "http://localhost:8080/client/session/login"
    ]
  ],
  "URIPROTO": [
    [
      "http"
    ]
  ],
  "USER": [
    [
      null
    ]
  ],
  "USERNAME": [
    [
      null
    ]
  ],
  "URIHOST": [
    [
      "localhost:8080"
    ]
  ],
  "IPORHOST": [
    [
      "localhost"
    ]
  ],
  "HOSTNAME": [
    [
      "localhost"
    ]
  ],
  "IP": [
    [
      null
    ]
  ],
  "IPV6": [
    [
      null
    ]
  ],
  "IPV4": [
    [
      null
    ]
  ],
  "port": [
    [
      "8080"
    ]
  ],
  "URIPATHPARAM": [
    [
      "/client/session/login"
    ]
  ],
  "URIPATH": [
    [
      "/client/session/login"
    ]
  ],
  "URIPARAM": [
    [
      null
    ]
  ],
  "SPACE": [
    [
      " ",
      " "
    ]
  ],
  "email": [
    [
      "abc.xyz@yahoo.com"
    ]
  ],
  "org": [
    [
      "backendorg"
    ]
  ]
}

HTTP 的 GROK 模式 URL

GROK pattern for HTTP URL

elasticsearch

logstash

logstash-grok