Regex 图案不';不匹配
我有一个简单的fluentd配置:Regex 图案不';不匹配,regex,fluentd,Regex,Fluentd,我有一个简单的fluentd配置: <source> @type tail @id in_tail_springboot_container_logs #path /var/log/containers/*.log path /var/log/logtest.txt #path /var/log/containers/springbootrabbitmqlistener-*.log pos_file /var/log/fluentd-springboot-co
<source>
@type tail
@id in_tail_springboot_container_logs
#path /var/log/containers/*.log
path /var/log/logtest.txt
#path /var/log/containers/springbootrabbitmqlistener-*.log
pos_file /var/log/fluentd-springboot-containers.log.pos
@log_level debug
multiline_flush_interval 5s
format multiline
format1 (?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}) (?<level>INFO|ERROR|WARN|TRACE|DEBUG|FATAL)\s+\[(?<app>[^\,]+),(?<zipkintraceid>[^\,]*),(?<zipkinspanid>[^\,]*),(?<zipkinsent>[^\]]*)] (?<someid>[0-9]+) --- \[(?<thread>[^\]]+)] (?<classname>[^\ ]+)\s+\: (?<text>.*)
format_firstline ?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}
tag springboot.*
read_from_head true
<parse>
@type json
time_format %Y-%m-%dT%H:%M:%S.%NZ
</parse>
</source>
我已经测试过了
一切正常
问题是fluent不喜欢它:
2018-11-09 08:48:18 +0000 [warn]: #0 [in_tail_springboot_container_logs] pattern not match: "2018-11-09 08:49:36.111 INFO [SpringBootMicroservice,id1,id2,true] 5820 --- [ main] o.s.j.e.a.AnnotationMBeanExporter : Bean with name 'environmentManager' has been autodetected for JMX exposure"
您能告诉我我的配置有什么问题吗?这行代码似乎有问题:
format_firstline ?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}
format_firstline?\d{4}-\d{2}-\d{2}:\d{2}:\d{2}.\d{3}
问题是名为group的时间戳格式不正确-它需要在整个组周围加括号,如下所示:
↓ ↓
format_firstline (?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{3})
↑
↓ ↓
格式_第一行(?\d{4}-\d{2}-\d{2}\d{2}:\d{2}:\d{2}\.\d{3})
↑
为了获得良好的实践,(正如Regex老手Wiktor所提到的)当
应该是文字点而不是通配符时,您应该转义它们。首先,转义应该匹配真实点的
。此外,还检查了《代码>格式>格式>格式>第一线?\d{4}{4}{4}{2}{2}\d{2}{2}{2}\d{2}\d{3}{{3}格式<代码>格式>格式<代码>格式<4{4}{2{2}\2}\2}\d{2{2{2}\2}\d{2}\d{2}\2}\d{2}\2}\d{2}\2}。\2}。\2}。\d{2}。\d{2}。\d{2}。\d{2}。\d{2}。\d{2}。\d{2}。\3}。\3}。\d{3}。\3}。\d{3}。\d{3}。\d{3}。\d{3}。\3。
↓ ↓
format_firstline (?<timestamp>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{3})
↑