Logstash 分析nginx错误日志的grok模式时出现问题

大家好，我在日志文件中有下面一行

2018/05/11 23:08:28 [error] 53734#53734: *621532077 upstream prematurely closed connection while reading response header from upstream, client: 192.168.22.10, server: www.testserver.pt, request: "GET /methods/userinfo.ashx/getUserOpenBetsData? HTTP/2.0", upstream: "https://188.11.2.3:443/methods/userinfo.ashx/getUserOpenBetsData?", host: "www.testserver.pt", referrer: "https://www.testserver.pt/"

我试图用下面的grok pathern来解析它

input {
    beats {
        port => "5044"
    }
}
 filter {
        grok{
        match => {"message" => '%{F_TIMESTAMP: timestamp} \[%{DATA:Message_type}\] %{DATA:EventId}\: \*%{NUMBER:Secondaryid} %{GREEDYDATA:Message}, client: %{IP:origin}, server: %{URIHOST:domain}, request: "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}", upstream: %{QS:userRequest}, host: "%{URIHOST:host}", referrer: %{QS:referrer}'}
        }
        date{
        locale => "en"
        match => ["timestamp", "YYYY/MM/dd HH:mm:ss"]
        target => "@timestamp"
        }
}
output {
    elasticsearch {
        hosts => [ "localhost:9200" ]
        index => "logstash-%{+YYYY.MM.dd.HH}"
        user => "elastic"
        password => "changeme"

---

不是在耍把戏。

一个简单的谷歌搜索显示了它的

NGINX

日志

您可以使用以下grok模式

(?<timestamp>%{YEAR}[./]%{MONTHNUM}[./]%{MONTHDAY} %{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER:threadid}\: \*%{NUMBER:connectionid} %{GREEDYDATA:errormessage}, client: %{IP:client}, server: %{GREEDYDATA:server}, request: %{GREEDYDATA:request}

你可以

请看以下内容 在github上

---

希望有帮助。

欢迎使用SO。如果你能在你的问题中添加更多的细节，比如，你得到了什么样的错误，以及它是什么类型的日志，这将非常有帮助？在你的情况下，它是NGINX日志，我已经发布了这个答案。如果有帮助，请告诉我。太好了！！谢谢，您的信息非常有用，但在配置多个管道时仍然存在一些问题，但我现在有了这个配置文件finished@ricardogaspar，很高兴我帮了忙，请随时为不同的问题发布其他问题，有人会尽力帮助。

{
  "timestamp": [
    [
      "2018/05/11 23:08:28"
    ]
  ],
  "YEAR": [
    [
      "2018"
    ]
  ],
  "MONTHNUM": [
    [
      "05"
    ]
  ],
  "MONTHDAY": [
    [
      "11"
    ]
  ],
  "TIME": [
    [
      "23:08:28"
    ]
  ],
  "HOUR": [
    [
      "23"
    ]
  ],
  "MINUTE": [
    [
      "08"
    ]
  ],
  "SECOND": [
    [
      "28"
    ]
  ],
  "severity": [
    [
      "error"
    ]
  ],
  "pid": [
    [
      "53734"
    ]
  ],
  "threadid": [
    [
      "53734"
    ]
  ],
  "BASE10NUM": [
    [
      "53734",
      "621532077"
    ]
  ],
  "connectionid": [
    [
      "621532077"
    ]
  ],
  "errormessage": [
    [
      "upstream prematurely closed connection while reading response header from upstream"
    ]
  ],
  "client": [
    [
      "192.168.22.10"
    ]
  ],
  "IPV6": [
    [
      null
    ]
  ],
  "IPV4": [
    [
      "192.168.22.10"
    ]
  ],
  "server": [
    [
      "www.testserver.pt"
    ]
  ],
  "request": [
    [
      ""GET /methods/userinfo.ashx/getUserOpenBetsData? HTTP/2.0", upstream: "https://188.11.2.3:443/methods/userinfo.ashx/getUserOpenBetsData?", host: "www.testserver.pt", referrer: "https://www.testserver.pt/""
    ]
  ]
}