如何在 logstash 中为 json 格式的嵌套文件编写过滤器部分

Question

我有以下日志文件。

{
    "level":"error",
    "msg":"err:ERR_AUTH_PORTAL_USER,tenantid:7,reason:out of access period,code:EP05,username:Che,venueid:10,devicemac:##-##-##-##-##-##,apmac:##-##-##-##-##-##,ssid:Jetwig,timestamp:Jan 22 2018 09:05:31 UTC",
    "time":"2018-01-22T14:35:31+05:30"
}

我想根据消息过滤它们：err:ERR_AUTH_PORTAL_USER 使用 logstash grok 过滤器。我该怎么做？

这是我目前尝试过的方法：

input {
    file {
        type => vampserror
        path => "/home/ampsErrorLog/getError/*"
                start_position => "beginning"
        }
}

filter {
    grok {
        patterns_dir => ["./patterns"] 
        match => {  "message" => "%{LOGLEVEL:level} %{MESSAGE:msg} %{TIMESTAMP:timestamp}" }
    }
}

if "ERR_AUTH_PORTAL_USER" in [msg] {

}

output {
    stdout { codec => rubydebug }
}

Answer 1

input { 
    file{
    type=>"json"
    path=>"logfile location"
    start_position => "beginning"
    }

}

filter {     

      json{
        source => "message"


     }   
}  

output {

    if[msg][err]=="ERR_AUTH_PORTAL_USER"{

    stdout { codec => rubydebug }

    mongodb {
    collection => "error"
    database => "dev"
    uri => "mongodb://localhost:27017"
    isodate => true

     }

    }

file{
        path => "/tmp/output.txt"
    }  

}

将此添加到您的 conf 文件中

 mongodb {
    collection => "error"
    database => "dev"
    uri => "mongodb://localhost:27017"
    isodate => true

     }

可选

如何在 logstash 中为 json 格式的嵌套文件编写过滤器部分

how to write filter section in logstash for json formatted nested file

json

logstash

logstash-grok