这是我要过滤的日志的示例行:
Request starting HTTP/1.1 GET http://api0.api.sin/api/social/v1/owner/4b3b60f6-1a54-4fbc-87b5-cc44496a6dbf/feeds/notifications/unread/count
我期待的结果如下:
{
"message": [
[
"Request starting"
]
],
"httpversion": [
[
"1.1"
]
],
"BASE10NUM": [
[
"1.1"
]
],
"verb": [
[
"GET"
]
],
"request": [
[
"http://api0.api.sin/api/social/v1/owner/feeds/notifications/unread/count"
]
],
"uuid": [
[
"4b3b60f6-1a54-4fbc-87b5-cc44496a6dbf"
]
]
}
我尝试使用以下 grok 表达式,但请求作为 2 个单独的值返回。
%{DATA:message}(?: HTTP/%{NUMBER:httpversion}) %{WORD:verb} %{NOTSPACE:request}%{UUID:uuid}%{NOTSPACE:request}