1

here is the example log of my server:

2023-07-14 16:33:58.464 [traceId:] [http-nio-9013-exec-10] INFO  com.tlx.usercenter.socket.service.WebSocketServer - websocket disconnect!

i use follow grok format:

grok {
match => { "message" => "(?<logTime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})\s+\[(?   <traceId>\S*)\]\s+\[(?<thread>.*)\]\s+(?<level>\w*)\s+(?<class>\S*)\s+\-\s+(?<content>.*)" }
  }

and logstash's log is following:

{
    "tags" => [
    [0] "multiline",
    [1] "_grokparsefailure"
    ],

    "level" => "INFO",
    "message" => "【websocket服务端】连接断开,总数为:1",
    "applicationName" => "log-user-center",
    "port" => 38058,
    "thread_name" => "http-nio-9013-exec-10",
    "logger_name" => "com.tlx.usercenter.socket.service.WebSocketServer",
    "@timestamp" => 2023-07-14T08:33:58.464Z,
    "host" => "gateway"
}

i dont know why tips "_grokparsefailure", i already use grok debugger test it and no problem,but i can not get the result which i want,there is no "content" property in logstash log

l want get the correct result which has property like "content"..etc

刘楠庭
  • 11
  • 1

0 Answers0