格羅克模式與此日誌行

Question

基本上我需要過濾掉日期 - 嚴重 - JAVACLASSNAME - 錯誤消息。

這是爲我工作..但它只是一半完成。 （0 [0-9] {4} - [0-9] {2} - [0-9] {2} [0-9] {2}：[0-9] {2}：[0- 9] {2}，[0-9] {3}）％{WORD：Severity}（？：％{GREEDYDATA：msg}）

它不顯示Javaclass ..！

這裏是輸出我得到

{ 
 
    "Timestamp": [ 
 
    [ 
 
     "2015-03-03 03:12:16,978" 
 
    ] 
 
    ], 
 
    "Severity": [ 
 
    [ 
 
     "INFO" 
 
    ] 
 
    ], 
 
    "Error_Message": [ 
 
    [ 
 
     " [http-bio-16006-exec-71] [XYZ.ABC.JLM.app.task.ERT] [app:/saas reqid:23121221 jsid:* aid:* uid: org: vorg: un:] - Received to update queued for monitorId=54213213JBNJBSJBSJBS, worklow=8u298u2189u312, session=21684216814321" 
 
    ] 
 
    ] 
 
}

的logline

2015-03-03 03:12:16,978 INFO [http-bio-16006-exec-71] [XYZ.ABC.JLM.app.task.ERT] [app:/saas reqid:23121221 jsid:* aid:* uid: org: vorg: un:] - Received to update queued for monitorId=54213213JBNJBSJBSJBS, worklow=8u298u2189u312, session=21684216814321 

Answer 1

這應該工作：

filter { 
    grok { 
    match => [ 
     "message", 
     "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:severity} \[(?<threadname>[^\]]+)\] \[(?<classname>[^\]]+)\] %{GREEDYDATA:message}" 
    ] 
    overwrite => ["message"] 
    } 
}