1

我正在使用 FluentD 和 Graylog GELF 进行日志记录，但成功有限。我想转发一个 JSON 文件：

<source>
  @type tail
  path /var/log/suricata/eve.json
  pos_file /var/log/td-agent/suri_eve.pos # pos record
  tag ids
  format json
  # JSON time stamp: 2016-02-01T11:52:49.157072+0000
  # this timestamp is ruby's t.strftime("%Y-%m-%dT%H:%M:%S.%6N%z")
  time_format %Y-%m-%dT%H:%M:%S.%6N%z
  time_key timestamp # I show a JSON message below
</source>

<match **>
  @type graylog
  host 1.2.3.4 #(optional; default="localhost")
  port 12201 #(optional; default=9200)
  flush_interval 30
  num_threads 2
</match>

这会启动，但会产生错误消息：

2016-02-01 15:30:11 +0000 [警告]: plugin/in_tail.rb:263:rescue in convert_line_to_event: "{\"timestamp\":\"2016-02-01T15:27:09.000087+0000\ ",\"flow_id\":51921072,\"event_type\":\"flow\",\"src_ip\":\"10.1.1.85\",\"src_port\":59820,\"dest_ip\": \"224.0.0.252\",\"dest_port\":5355,\"proto\":\"UDP\",\"flow\":{\"pkts_toserver\":4,\"pkts_toclient\":0 ,\"bytes_toserver\":294,\"bytes_toclient\":0,\"start\":\"2016-02-01T15:26:30.393371+0000\",\"end\":\"2016-02 -01T15:26:37.670904+0000\",\"age\":7,\"state\":\"new\",\"reason\":\"timeout\"}}" error="无效时间格式：值 = 2016-02-01T15:27:09.000087+0000，error_class = ArgumentError，错误 = 无效的 strptime 格式 - `%Y-%m-%dT%H:%M:%S.%6N%z'"

原始消息如下所示：

{"timestamp":"2016-02-01T15:31:02.000699+0000","flow_id":52015920,"event_type":"flow","src_ip":"10.1.1.44","src_port":49313,"dest_ip":"224.0.0.252","dest_port":5355,"proto":"UDP","flow":{"pkts_toserver":2,"pkts_toclient":0,"bytes_toserver":128,"bytes_toclient":0,"start":"2016-02-01T15:30:31.348568+0000","end":"2016-02-01T15:30:31.759024+0000","age":0,"state":"new","reason":"timeout"}}

所以我检查了Ruby 文档。我对 FluentD 不太熟悉，但据我所知，时间格式表达式应该适合？我试过format=none了，但这也行不通。

4

1 回答 1

1

https://github.com/Graylog2/graylog2-server/issues/1761

这是 Graylog2 中保留字段（未记录）的错误/问题。如果您发现与时间戳类似的错误，请检查链接的问题和开发响应。

于 2016-02-05T11:55:51.367 回答