如何獲得設置匹配「N」線的使用logstash

Question

我從那裏我試圖讓設置符合我的神交enter code here

日誌行的日誌跟蹤日誌時間：

CNTR0020E: EJB threw an unexpected (non-declared) exception during invocation of method "getCustomerDashBoardCVAHistoricalDataRequestCount" on bean "BeanId(cva-admin-ear#vis-ejb-cva-4.20.0.0-SNAPSHOT.jar#CustomerDashboardServiceBean, null)". Exception data: java.lang.RuntimeException: com.ibm.websphere.naming.CannotInstantiateObjectException: Exception occurred while the JNDI NamingManager was processing a javax.naming.Reference object. [Root exception is com.ibm.websphere.ejbcontainer.AmbiguousEJBReferenceException: The short-form default binding 'za.co.sb.archiving.midtier.ejb.HistoricalDataRequestBusinessServiceRemote' is ambiguous because multiple beans implement the interface : [channel-frontendEAR#channel-biz-ejb-3-4.20.0.0-SNAPSHOT.jar#HistoricalDataRequestBusinessServiceBean, nbol-rest-0_0_1-20150729_102930-10_war#nbol-rest-0.0.1-20150729.102930-10.war#HistoricalDataRequestBusinessServiceBean]. Provide an interface specific binding or use the long-form default binding on lookup.] 
    at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getRequestBusinessService(CustomerDashboardVisServicePojo.java:355) 
    at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getHistoricalDataRequestCount(CustomerDashboardVisServicePojo.java:282) 
    at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getCustomerDashBoardHistoricalDataRequestCount(CustomerDashboardVisServicePojo.java:249) 
    at za.co.sb.channel.cva.customerdashboard.midtier.ejb.CustomerDashboardServiceBean.getCustomerDashBoardCVAHistoricalDataRequestCount(CustomerDashboardServiceBean.java:49) 
    at za.co.sb.channel.cva.customerdashboard.midtier.ejb.EJSLocal0SLCustomerDashboardServiceBean_7d8a7f63.getCustomerDashBoardCVAHistoricalDataRequestCount(EJSLocal0SLCustomerDashboardServiceBean_7d8a7f63.java) 
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
    at java.lang.reflect.Method.invoke(Method.java:597) 
    at za.co.sb.midtier.processservice.ProcessServiceImpl.callService(ProcessServiceImpl.java:770) 
    at za.co.sb.midtier.processservice.ProcessServiceImpl.retrieveResultData(ProcessServiceImpl.java:1151) 
    at za.co.sb.midtier.processservice.ProcessServiceImpl.process(ProcessServiceImpl.java:248) 
    at za.co.sb.midtier.processservice.ProcessServiceBean.process(ProcessServiceBean.java:63) 
    at za.co.sb.midtier.processservice.EJSRemote0SLCustomerAdminProcessService_450d08b4.process(EJSRemote0SLCustomerAdminProcessService_450d08b4.java) 
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
Caused by: com.ibm.websphere.naming.CannotInstantiateObjectException: Exception occurred while the JNDI NamingManager was processing a javax.naming.Reference object. [Root exception is com.ibm.websphere.ejbcontainer.AmbiguousEJBReferenceException: The short-form default binding 'za.co.sb.archiving.midtier.ejb.HistoricalDataRequestBusinessServiceRemote' is ambiguous because multiple beans implement the interface : [channel-frontendEAR#channel-biz-ejb-3-4.20.0.0-SNAPSHOT.jar#HistoricalDataRequestBusinessServiceBean, nbol-rest-0_0_1-20150729_102930-10_war#nbol-rest-0.0.1-20150729.102930-10.war#HistoricalDataRequestBusinessServiceBean]. Provide an interface specific binding or use the long-form default binding on lookup.] 
    at com.ibm.ws.naming.util.Helpers.processSerializedObjectForLookupExt(Helpers.java:1103) 
    at com.ibm.ws.naming.util.Helpers.processSerializedObjectForLookup(Helpers.java:796) 
    at com.ibm.ws.naming.jndicos.CNContextImpl.processBoundObjectForLookup(CNContextImpl.java:2876) 
    at com.ibm.ws.naming.jndicos.CNContextImpl.processResolveResults(CNContextImpl.java:3973) 
    at com.ibm.ws.naming.jndicos.CNContextImpl.doLookup(CNContextImpl.java:1875) 
    at com.ibm.ws.naming.jndicos.CNContextImpl.doLookup(CNContextImpl.java:1776) 
    at com.ibm.ws.naming.jndicos.CNContextImpl.lookupExt(CNContextImpl.java:1433) 
    at com.ibm.ws.naming.jndicos.CNContextImpl.lookup(CNContextImpl.java:615) 
    at com.ibm.ws.naming.util.WsnInitCtx.lookup(WsnInitCtx.java:165) 
    at com.ibm.ws.naming.util.WsnInitCtx.lookup(WsnInitCtx.java:179) 
    at org.apache.aries.jndi.DelegateContext.lookup(DelegateContext.java:161) 
    at 

神交圖樣：CUSTOM_ZACOSB（？：？\ A *在za.co.sb. {5}）

用法中篩選：

grok{ 
    match => ["ParseContent","%{CUSTOM_ZACOSB:ProjectLocation}"] 
    add_tag => "ProjectLocation" 
} 

輸出繼電器： 「ProjectLocation」=> 「在za.co.sb.chan」

預期輸出：

at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getRequestBusinessService(CustomerDashboardVisServicePojo.java:355) 
    at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getHistoricalDataRequestCount(CustomerDashboardVisServicePojo.java:282) 
    at za.co.sb.channel.cva.customerdashboard.midtier.pojo.CustomerDashboardVisServicePojo.getCustomerDashBoardHistoricalDataRequestCount(CustomerDashboardVisServicePojo.java:249) 
    at za.co.sb.channel.cva.customerdashboard.midtier.ejb.CustomerDashboardServiceBean.getCustomerDashBoardCVAHistoricalDataRequestCount(CustomerDashboardServiceBean.java:49) 
    at za.co.sb.channel.cva.customerdashboard.midtier.ejb.EJSLocal0SLCustomerDashboardServiceBean_7d8a7f63.getCustomerDashBoardCVAHistoricalDataRequestCount(EJSLocal0SLCustomerDashboardServiceBean_7d8a7f63.java) 

可有人點我這樣做是錯誤的。這將有很大的幫助。我只想要那五條線不休息，我的過濾器能夠找到內容，但它不會更進一步。如果我修改它捕獲整個日誌，我不想要。

Answer 1

看起來您並未將多行堆棧跟蹤轉換爲單個消息以供logstash處理。 Filebeat和logstash都具有多線功能。一旦你有一條消息，你可以調整你的正則表達式。