Regex Fluentd从Docker捕获堆栈跟踪
我试图让Fluentd解析来自Docker日志驱动程序的Java堆栈跟踪,使用in_tail并将它们作为单个消息发出 为了我的生活,我不明白为什么他们还在分开 这是一个正在写入文件的示例输入:Regex Fluentd从Docker捕获堆栈跟踪,regex,docker,fluentd,Regex,Docker,Fluentd,我试图让Fluentd解析来自Docker日志驱动程序的Java堆栈跟踪,使用in_tail并将它们作为单个消息发出 为了我的生活,我不明白为什么他们还在分开 这是一个正在写入文件的示例输入: 2015-12-17T19:19:47+00:00 docker.java.ubuntu:15.10 {"log":"Exception in thread main java.lang.NullPointerException\r","container_id":"5a064eb2346535
2015-12-17T19:19:47+00:00 docker.java.ubuntu:15.10 {"log":"Exception in thread main java.lang.NullPointerException\r","container_id":"5a064eb23465350a11fe00b1f7787f5bd3e9f0182dd44c09516a72ab4006bd54","container_name":"/src-test_1.0.0.353_989549167.1","source":"stdout"}
2015-12-17T19:19:47+00:00 docker.java.ubuntu:15.10 {"container_id":"5a064eb23465350a11fe00b1f7787f5bd3e9f0182dd44c09516a72ab4006bd54","container_name":"/src-test_1.0.0.353_989549167.1","source":"stdout","log":" at com.example.myproject.Book.getTitle(Book.java:16)\r"}
2015-12-17T19:19:47+00:00 docker.java.ubuntu:15.10 {"container_name":"/src-test_1.0.0.353_989549167.1","source":"stdout","log":" at com.example.myproject.Author.getBookTitles(Author.java:25)\r","container_id":"5a064eb23465350a11fe00b1f7787f5bd3e9f0182dd44c09516a72ab4006bd54"}
2015-12-17T19:19:47+00:00 docker.java.ubuntu:15.10 {"container_id":"5a064eb23465350a11fe00b1f7787f5bd3e9f0182dd44c09516a72ab4006bd54","container_name":"/src-test_1.0.0.353_989549167.1","source":"stdout","log":" at com.example.myproject.Bootstrap.main(Bootstrap.java:14)\r"}
2015-12-17T19:19:47+00:00 docker.java.ubuntu:15.10 {"container_id":"5a064eb23465350a11fe00b1f7787f5bd3e9f0182dd44c09516a72ab4006bd54","container_name":"/src-test_1.0.0.353_989549167.1","source":"stdout","log":"test\r"}
这是我用于in_tail的配置:
<source>
@type tail
tag docker.multiline
path /tmp/fluent/java*
pos_file /tmp/fluent/log.pos
refresh_interval 10
format multiline
format first_line /.*\"log\":\"[^\s].*/
format /\"log\":\"(?<message>.+)\\r/
</source>
@型尾
标记docker.multiline
path/tmp/fluent/java*
pos_文件/tmp/fluent/log.pos
刷新间隔10
格式化多行
格式化第一行/*\“日志\:\”[^\s]*/
格式/\“日志\”:\“(?。+)\\r/
正则表达式在我看来是正确的,当我将它们插入正则表达式测试器时,第一行正则表达式只匹配样本的第一行和最后一行,而格式正则表达式匹配每一行,但只捕获堆栈跟踪信息,正如我所期望的那样。然而,它们都作为单独的消息出现,几乎就像第一行匹配每一行,而不是第一行和最后一行。根据,配置键应该是format\u firstline
和format
(而不是format first\u line
和format
)