elasticsearch - 基于二和条件过滤文本以获取 logstash 配置的 if 条件

Question

我有一个日志文件。日志文件包含许多 db-exceptions 。我有兴趣在 ElasticSearch 中使用 logstash 和索引来获取所有异常

例外 ：

05-06-19 05:34:42.794     6a5ba226-da6a-469a-8304-2f79f68fdbcd        http-bio-8080-exec-8     ERROR     c.w.m.n.o.i.o.r.XYZRepo         executeMerge      157     Failed while processing deliveryList:[deliveryTO{deliveryNumber=92183914, itemNumber=565683539, asnNumber='0664420512', channelMethod='SSTKU,CROSSU', baseDivisionName='wm', countryCode='US' itemUomCode='null', poInd='r', obsoleteInd=null, processStatus='null', itemQuantity=null, overageItemQuantity=null, availableQuantity=322, whpkQuantity=null, vnpkQuantity=null, unfulfilledQty=null ,newItemQty=null} ] with exception:{} com.a.b.c.exceptions.MyDBException: ExceptionCode-BE-00028 

Logstash 过滤器：

filter {
  grok{
      match => { "message" => "%{TIMESTAMP_ISO8601:Date}%{DATA:corelationid}%{LOGLEVEL:loglevel}%{DATA:javaclass}%{NUMBER:number}%{GREEDYDATA:content}" }
      overwrite => ["message"]
 }

  if  ("ERROR" not in [loglevel] and "ExceptionCode-BE-00028" not in [content])  {
       drop { }
  }   
}

Logstash 输出：

output {
stdout {
    codec => dots
} 
elasticsearch {
   index => "db-failure"
  }
}

标签： elasticsearchlogstashlogstash-groklogstash-configuration