如何在logstash中編寫grok過濾器以接受可變參數

Question

如何編寫grok過濾規則，如果消息包含可變參數的事務。

例如：

22-Jun-2015 04:45:56 Transaction for Bill 123 item1=100 item2=200 item3=300 
22-Jun-2015 05:45:23 Transaction for Bill 124 item1=200 
22-Jun-2015 06:23:36 Transaction for Bill 125 item4=400 item2=200 item1=100 item5=500 

我們可以匹配日期，時間，比爾在上述情況下，但如何在這裏辦理可變參數項。

Answer 1

最後我能做到這一點使用KV {} logstash

的選項，例如：

item1=100&item2=200&item3=300 
item1=100&item2=200&item3=300&item4=400 

我創建了兩個消息，然後我得到了下面的輸出;

{ 
    "message" => "item1=100&item2=200&item3=300", 
    "@version" => "1", 
"@timestamp" => "2015-07-04T19:20:15.831Z", 
     "host" => "viswesn-PC", 
    "item1" => "100", 
    "item2" => "200", 
    "item3" => "300", 
     "tags" => [ 
      [0] "true" 
     ] 
} 
    { 
    "message" => "item1=100&item2=200&item3=300&item4=400", 
    "@version" => "1", 
"@timestamp" => "2015-07-04T19:20:25.866Z", 
     "host" => "viswesn-PC", 
    "item1" => "100", 
    "item2" => "200", 
    "item3" => "300", 
    "item4" => "400", 
     "tags" => [ 
     [0] "true" 
    ] 
}