0

我试图打破记录在同一行中的两个日志，因为下一个日志在提取时没有在结果中发布，而它显示在事件日志中。

02:09:50.296 64785434 [http-bio-8085-exec-156] INFO  c.i.p.w.r.s.AdjustmentServiceImpl - publicRequest: ,AccountID=123147309786219,ProductName="Product Online",ProductFlavor="ENHANCED",EventType=Usage,AdjustmentType=event,AdjustmentInputType=Amount,BillDate=2018-07-09,AdjustmentReason="Chargeback Event Adjustment",,SOAP Request:,AccountPOID="0.0.0.1 /account 324245253535",EventPOID="0.0.0.1 /event/activity/usage/payroll_per_employee 311258547968527414",AdjustmentAmount=1,AdjustmentPercentage=,Currency=GBP,Bill-ItemNo=23627727,1,AdjustmentDate=2018-07-14T04:00-07:00,IS_DEBIT_OR_CREDIT=CREDIT,TaxTreatment="Included Taxes in this adjustment",,SOAP Response:HttpStatus=200,,
02:09:50.826 64785964 [http-bio-8085-exec-156] INFO  c.i.p.w.r.s.AdjustmentServiceImpl - publicRequest: ,AccountID=123147309786219,ProductName="Product Online",ProductFlavor="ENHANCED",EventType=Usage,AdjustmentType=event,AdjustmentInputType=Amount,BillDate=2018-07-09,AdjustmentReason="Chargeback Event Adjustment",,SOAP Request:,AccountPOID="0.0.0.1 /account 324245253535",EventPOID="0.0.0.1 /event/activity/usage/payroll_per_employee 7378383763636373",AdjustmentAmount=1,AdjustmentPercentage=,Currency=GBP,Bill-ItemNo=23627727,1,AdjustmentDate=2018-07-14T04:00-07:00,IS_DEBIT_OR_CREDIT=CREDIT,TaxTreatment="Included Taxes in this adjustment",,SOAP Response:HttpStatus=200,,

如果您看到上面的日志，这两个事件被设置在同一行中，但我无法在表中提取为两个事件。

请建议我如何将其提取为两个事件。

4

1 回答 1

0

如果您可以识别事件之间的分隔符，请查看makemv命令。它可以将事件拆分为多值字段。通过管道将mvexpand其创建为要处理的单独事件。

于 2018-05-16T02:48:24.523 回答