我需要为下面的 websphere 日志定义 grok grok 模式答案

【问题标题】：I need to define grok grok pattern for below websphere log我需要为下面的 websphere 日志定义 grok grok 模式
【发布时间】：2020-01-27 17:36:01
【问题描述】：

请帮我为以下日志创建 grok 模式：

{ "sysdate":"[08/Jun/2019:00:00:12 -0400]", "site":"abcd.net", "host":"hostnam.net", "method":"POST", "request":"/services/path", "querystring":"", "port":"4123", "username":"-", "cookie":"0000k1cgki:1f:1bv8tat", "coauthsessionid":"-", "clienthost":"44.25.14.241", "httpversion":"HTTP/1.1", "useragent":"-", "referer":"-", "responsestatus":"200", "subresponse":"0", "win32status":"0", "sbytes":"799", "cbytes":"0", "timetaken":"3595" }

【问题讨论】：

可以直接发送json格式到Logstash或者ES。 elastic.co/guide/en/logstash/current/plugins-filters-json.html
你想用grok 模式做什么？您想要获取的任何特定字段或值，或者只是那里的每个字段？数据似乎已经是 JSON 格式了

标签： logstash logstash-grok elk

【解决方案1】：

试试这个：

输入：

{"sysdate":"[08/Jun/2019:00:00:12 -0400]","site":"abcd.net","host":"hostnam.net", "method":"POST", "request":"/services/path", "querystring":"", "port":"4123", "username":"-", "cookie":"0000k1cgki:1f:1bv8tat", "coauthsessionid":"-", "clienthost":"44.25.14.241", "httpversion":"HTTP/1.1", "useragent":"-", "referer":"-", "responsestatus":"200", "subresponse":"0", "win32status":"0", "sbytes":"799", "cbytes":"0", "timetaken":"3595"}

GROK 模式：

\{"sysdate":"%{GREEDYDATA:sysdate}","site":"%{GREEDYDATA:site}","host":"%{GREEDYDATA:host}", "method":"%{GREEDYDATA:method}", "request":"%{GREEDYDATA:request}", "querystring":"%{GREEDYDATA:querystring}", "port":"%{GREEDYDATA:port}", "username":"%{GREEDYDATA:username}", "cookie":"%{GREEDYDATA:cookie}", "coauthsessionid":"%{GREEDYDATA:coauthsessionid}", "clienthost":"%{GREEDYDATA:clienthost}", "httpversion":"%{GREEDYDATA:httpversion}", "useragent":"%{GREEDYDATA:useragent}", "referer":"%{GREEDYDATA:referer}", "responsestatus":"%{GREEDYDATA:responsestatus}", "subresponse":"%{GREEDYDATA:subresponse}", "win32status":"%{GREEDYDATA:win32status}", "sbytes":"%{GREEDYDATA:sbytes}", "cbytes":"%{GREEDYDATA:cbytes}", "timetaken":"%{GREEDYDATA:timetaken}"\}

输出：

{
  "sysdate": [
    [
      "[08/Jun/2019:00:00:12 -0400]"
    ]
  ],
  "site": [
    [
      "abcd.net"
    ]
  ],
  "host": [
    [
      "hostnam.net"
    ]
  ],
  "method": [
    [
      "POST"
    ]
  ],
  "request": [
    [
      "/services/path"
    ]
  ],
  "querystring": [
    [
      ""
    ]
  ],
  "port": [
    [
      "4123"
    ]
  ],
  "username": [
    [
      "-"
    ]
  ],
  "cookie": [
    [
      "0000k1cgki:1f:1bv8tat"
    ]
  ],
  "coauthsessionid": [
    [
      "-"
    ]
  ],
  "clienthost": [
    [
      "44.25.14.241"
    ]
  ],
  "httpversion": [
    [
      "HTTP/1.1"
    ]
  ],
  "useragent": [
    [
      "-"
    ]
  ],
  "referer": [
    [
      "-"
    ]
  ],
  "responsestatus": [
    [
      "200"
    ]
  ],
  "subresponse": [
    [
      "0"
    ]
  ],
  "win32status": [
    [
      "0"
    ]
  ],
  "sbytes": [
    [
      "799"
    ]
  ],
  "cbytes": [
    [
      "0"
    ]
  ],
  "timetaken": [
    [
      "3595"
    ]
  ]
}

您可以使用this 进行grok 写作。

【讨论】：

我认为这是一个糟糕的解决方案，因为它会在输入的第一次更改时中断。使用 json 过滤器会更好，因为它是有效的 json。
@baudsp 你的观点是正确的。但是 OP 已要求给定 json 的 grok 模式。所以我认为这个答案与 OP 的要求相符。您应该在问题评论部分向 OP 提出建议。