logstash-grok - 与 URIPATH 匹配的 GROK 模式

Question

这是我的示例网址

http://localhost:8080/abc2/query/errorLogs

只是试图提取query/errorLogs. 为此，我尝试了以下 GROK patten

(%{URIPROTO}://%{URIHOST}(?<path>/[^/]+/[^/]+/[^/]+))

下面的输出我得到

{
  "URIPROTO": [
    [
      "http"
    ]
  ],
  "URIHOST": [
    [
      "localhost:8080"
    ]
  ],
  "IPORHOST": [
    [
      "localhost"
    ]
  ],
  "HOSTNAME": [
    [
      "localhost"
    ]
  ],
  "IP": [
    [
      null
    ]
  ],
  "IPV6": [
    [
      null
    ]
  ],
  "IPV4": [
    [
      null
    ]
  ],
  "port": [
    [
      "8080"
    ]
  ],
  "path": [
    [
      "/abc2/query/errorLogs"
    ]
  ]
}

但我期望路径应该是“/query/errorLogs”。

标签： logstash-grok

Answer 1

试试这个 ：

(%{URIPROTO}://%{URIHOST}(?<first_path>/[^/]+)%{GREEDYDATA:path})

结果：

port    8080
first_path  /abc2
path    /query/errorLogs