用于ping的Logstash Grok图案

我从日志中获取了以下示例：

Tue Mar 27 06:51:48 2018 PING www.google.com (172.217.169.100) 56(84) bytes of data.
64 bytes from sof02s31-in-f4.1e100.net (172.217.169.100): icmp_seq=1 ttl=128 time=17.4 ms

--- www.google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 17.482/17.482/17.482/0.000 ms

我想为logstash创建一个grok模式，并从最后两行中提取诸如

TIMESTAMP

，

IPV4

，

TTL

，以及

RTT

值

min/avg/max

此日志每秒左右从ping脚本发送到同一IP。我想我需要一个多行模式来同时获取这6行中每一行的值

任何帮助都将是伟大的

---

谢谢

如果您使用

Oniguruma语法

来转义

新行

，即

\n

，则不需要多行

例如，

（？（.|\r |\n）*）

可以在两段之间匹配日志中所有不必要的数据，即

“时间=17.4毫秒\n\n---www.google.com ping statistics---\n1数据包 已发送，1个已接收，0%数据包丢失，时间为0ms\n“

你最后的grok模式会是这样的

%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR} %{WORD:PING} %{HOSTNAME:host} \(%{IP:ip_address}\) %{DATA} ttl=%{INT:TTL}(?<newline>(.|\r|\n)*)rtt min/avg/max/mdev = %{NUMBER:min}/%{NUMBER:avg}/%{NUMBER:max}/%{NUMBER:mdev} ms

---

您可以使用像

（？（.|\r |\n）*）这样的自定义模式来转义两行之间的空格。

请阅读我的答案。谢谢

{
  "DAY": [
    [
      "Tue"
    ]
  ],
  "MONTH": [
    [
      "Mar"
    ]
  ],
  "MONTHDAY": [
    [
      "27"
    ]
  ],
  "TIME": [
    [
      "06:51:48"
    ]
  ],
  "HOUR": [
    [
      "06"
    ]
  ],
  "MINUTE": [
    [
      "51"
    ]
  ],
  "SECOND": [
    [
      "48"
    ]
  ],
  "YEAR": [
    [
      "2018"
    ]
  ],
  "PING": [
    [
      "PING"
    ]
  ],
  "host": [
    [
      "www.google.com"
    ]
  ],
  "ip_address": [
    [
      "172.217.169.100"
    ]
  ],
  "IPV6": [
    [
      null
    ]
  ],
  "IPV4": [
    [
      "172.217.169.100"
    ]
  ],
  "DATA": [
    [
      "56(84) bytes of data. 64 bytes from sof02s31-in-f4.1e100.net (172.217.169.100): icmp_seq=1"
    ]
  ],
  "TTL": [
    [
      "128"
    ]
  ],
  "newline": [
    [
      " time=17.4 ms\n\n--- www.google.com ping statistics ---\n1 packets transmitted, 1 received, 0% packet loss, time 0ms\n"
    ]
  ],
  "min": [
    [
      "17.482"
    ]
  ],
  "BASE10NUM": [
    [
      "17.482",
      "17.482",
      "17.482",
      "0.000"
    ]
  ],
  "avg": [
    [
      "17.482"
    ]
  ],
  "max": [
    [
      "17.482"
    ]
  ],
  "mdev": [
    [
      "0.000"
    ]
  ]
}