Xml Logstash-将多行消息拆分为头和尾
我试图解析一个日志文件，其中包含XML和其他任意输出。 在特定情况下，我想检查预订是否已成功发送给客户Xml Logstash-将多行消息拆分为头和尾,xml,logstash,multiline,grok,Xml,Logstash,Multiline,Grok,我试图解析一个日志文件，其中包含XML和其他任意输出。 在特定情况下，我想检查预订是否已成功发送给客户 [11-28-51.440000] Sending reservation to customer [11-28-51.492900] <?xml version="1.0" encoding="UTF-8"?><SendReservation><ReservationId>1289</ReservationId><Customer>
[11-28-51.440000] Sending reservation to customer
[11-28-51.492900] <?xml version="1.0" encoding="UTF-8"?><SendReservation><ReservationId>1289</ReservationId><Customer>2892</Customer>...</SendReservation>
[11-28-51.493000] Status: Successfull
[11-28-52.261000] Something different
[11-28-51.520000] Sending reservation to customer
[11-28-54.548900] <?xml version="1.0" encoding="UTF-8"?><SendReservation><ReservationId>2732</ReservationId><Customer>7856</Customer>...</SendReservation>
[11-28-54.600000] Status: Error: Reservation was rejected
input {
file {
path => "test.log"
start_position => "beginning"
type => "reservation"
codec => multiline {
pattern => "\[(.*?)\](.*?)<\?xml[^>]*>"
negate => true
what => previous
}
}
}
"message" => "[11-28-51.492900] <?xml version="1.0" encoding="UTF-8"?><SendReservation><ReservationId>1289</ReservationId><Customer>2892</Customer>...</SendReservation>\n[11-28-51.493000] Status: Successfull\n[11-28-52.261000] Something different\n[11-28-51.520000] Sending reservation to customer
mutate {
gsub => [ "message", "^(.*?)<\?xml[^>]*>", "" ]
}
mutate {
gsub => [ "message", "(?<=<\/SendReservation>).*$", "" ]
}
grok { match => { "message" => "(?<head>(\[(.*?)\](.*?)<\?xml[^>]*>(.*?)<\/SendReservation>))+(?<tail>(?<=<\/SendReservation>)(.|\n)*$)" } }