Logstash模式匹配超过它应该

我有一个日志行（多比赛），看起来像以下：Logstash模式匹配超过它应该

3574874 14/Jul/2016 20:42:37 +0000 ERROR [http-bio-0.0.0.0-8443-exec-128] error_jsp   _jspService > could not lock: [com.myCompany.myProject.bean.scheduling.Area#6306]; SQL [/* UPGRADE lock com.myCompany.myProject.bean.scheduling.Area */ select Area_id from Area_ID where Area_id =? and Area_Version =? for update]; nested exception is org.hibernate.exception.LockAcquisitionException: could not lock: [com.myCompany.myProject.bean.scheduling.Area#6306] 
org.springframework.dao.CannotAcquireLockException: could not lock: [com.myCompany.myProject.bean.scheduling.MyClass#6306]; SQL [/* UPGRADE lock com.myCompany.myProject.bean.scheduling.MyClass */ select Area_ID from Area where Area =? and Area =? for update]; nested exception is org.hibernate.exception.LockAcquisitionException: could not lock: [com.myCompany.myProject.bean.scheduling.Area#6306] 
    at org.springframework.orm.hibernate3.SessionFactoryUtils.convertHibernateAccessException(SessionFactoryUtils.java:639) 
    at org.springframework.orm.hibernate3.HibernateExceptionTranslator.convertHibernateAccessException(HibernateExceptionTranslator.java:89) 
    at org.springframework.orm.hibernate3.HibernateExceptionTranslator.translateExceptionIfPossible(HibernateExceptionTranslator.java:68) 
    at org.springframework.dao.support.ChainedPersistenceExceptionTranslator.translateExceptionIfPossible(ChainedPersistenceExceptionTranslator.java:58) 
    at org.springframework.dao.support.DataAccessUtils.translateIfNecessary(DataAccessUtils.java:213) 
    at org.springframework.dao.support.PersistenceExceptionTranslationInterceptor.invoke(PersistenceExceptionTranslationInterceptor.java:163) 
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172) 
    at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:633) 
    at com.myCompany.myProject.dal.hibernate.Impl$$EnhancerBySpringCGLIB$$535be625.lock(<generated>) 
    at com.myCompany.myProject.scheduling.Area.AreaClose(MyClass.java:1265) 
    at com.myCompany.myProject.scheduling.Area.handleProviderDisconnect(MyClass.java:1190) 
    at com.myCompany.myProject.scheduling.Area$$FastClassBySpringCGLIB$$220c3d67.invoke(<generated>) 
    at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204) 
    at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:700)

我的病毒码文件规定的东西出来是这样的：

# AW Tomcat formatting 
    TOMCAT_DATE %{MONTHDAY}[./-]%{MONTH}[./-]%{YEAR} 
    TOMCAT_TS %{BASE10NUM} 
    #%{BASE10NUM} 
    TOMCAT_TIME %{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9]) 
    TOMCAT_THREAD \[(.+?)\] 
    TOMCAT_CLASS [A-Za-z0-9]+ 
    TOMCAT_CLASS_METHOD %{NOTSPACE} 
    TOMCAT_TIMESTAMP %{TOMCAT_DATE}[\s]+%{TOMCAT_TIME} 
    TOMCAT_MESSAGE .+ 
    TOMCAT_IP %{IP} 
    TOMCAT_DATA %{NOTSPACE} 

    TOMCAT_LOG (?:%{TOMCAT_TS:log_ts})[\s]+(?:%{TOMCAT_TIMESTAMP:log_timestamp})[\s]+%{INT}[\s]+(?:%{LOGLEVEL:log_level})[\s]+(?:%{TOMCAT_THREAD:thread})[\s]+(?:%{TOMCAT_CLASS:class_name})[\s]$

当我在logstash中看起来像线程的代码不仅仅是线程匹配......它与[com.myCompany.myProject.bean.scheduling.MyClass＃6306]一路匹配;

当我取适量线程和后空间正则表达式和折腾它regexr或regex101使用我不能重新创建：

\[(.+?)\][\s]+

有没有人对为什么正则表达式是工作无处不在，但洞察力logstash？此外，这也适用于我的传入tomcat日志的约99.5％以及...

来源

2016-07-14 A_Elric

您在您的日志中有+。你需要与\+匹配，或使其可选的\+?：

TOMCAT_LOG (?:%{TOMCAT_TS:log_ts})\s+(?:%{TOMCAT_TIMESTAMP:log_timestamp})\s+\+?%{INT}\s+(?:%{LOGLEVEL:log_level})\s+(?:%{TOMCAT_THREAD:thread})\s+(?:%{TOMCAT_CLASS:class_name})\s*$ 
                      ^^^

来源

2016-07-15 08:20:49

这里是一个[粗糙的正则表达式检查】（https://regex101.com/r/oR0wI0/1）。 –

这是你已经帮助过我的一排，所以首先，非常感谢你。其次，您是否有任何资源可以帮助我解决一般由grok/logstash引起的正则表达式问题？谢谢， –

Oniguruma正则表达式实际上可以在http://rubular.com进行测试。 http://grokdebug.herokuapp.com/很好，可以测试内置和自定义模式。我认为这已经足够了，只要你有一些正则表达式的知识就可以完全控制模式的功能。 –

Logstash模式匹配超过它应该

回答

相关问题