Logstash不對Apache日誌應用過濾器

我想使用ELK堆棧解析一些Apache訪問日誌，但是我在使用logstash時未應用在任何Apache日誌中創建的Apache過濾器。這裏是我的過濾器文件：Logstash不對Apache日誌應用過濾器

filter { 
    if [type] == "apache_access" { 
    grok { 
     patterns_dir => ["/opt/logstash/patterns/apache"] 
     add_tag => ["grokked", "apache"] 
     match => ["messege", "%{IP:client} - - \[%{HTTPDATE:event_date}\] %{QS:first} %{NUMBER:response} %{NUMBER:bytes} %{QS:destination} %{QS:browser}"] 
    } 
    } 
}

filebeat配置：

filebeat: 
    prospectors: 
    - 
     paths: 
     - /var/log/apache2/access.log 
     document_type: apache_access 
    registry_file: /var/lib/filebeat/registry

而且我使用的是從logz.io爲例日誌文件，它包含了類似下面的日誌：

88.114.162.149 - - [04/Aug/2016:00:00:05 +0000] "GET /item/giftcards/3802 HTTP/1.1" 200 82 "/category/books" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:9.0.1) Gecko/20100101 Firefox/9.0.1" 
156.141.192.36 - - [04/Aug/2016:00:00:10 +0000] "GET /category/toys?from=20 HTTP/1.1" 200 135 "/category/toys" "Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11" 
92.213.110.215 - - [04/Aug/2016:00:00:15 +0000] "GET /category/software HTTP/1.1" 200 108 "/category/books" "Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11" 
80.225.119.24 - - [04/Aug/2016:00:00:20 +0000] "GET /category/cameras HTTP/1.1" 200 100 "http://www.google.com/search?ie=UTF-8&q=google&sclient=psy-ab&q=Cameras+Books&oq=Cameras+Books&aq=f&aqi=g-vL1&aql=&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.,cf.osb&biw=2640&bih=427" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; YTB730; GTB7.2; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; Media Center PC 6.0)" 
208.219.150.176 - - [04/Aug/2016:00:00:25 +0000] "GET /category/software HTTP/1.1" 200 117 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; GTB7.2; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C)" 
160.165.186.172 - - [04/Aug/2016:00:00:30 +0000] "GET /category/office HTTP/1.1" 200 101 "/category/electronics" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; YTB720; GTB7.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)" 
224.150.219.97 - - [04/Aug/2016:00:00:35 +0000] "GET /category/jewelry HTTP/1.1" 200 74 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

我已經在grokdebug中檢查了我的過濾器，並且在那裏一切工作正常，但是每次我將這些日誌推入logstash時，它都不會應用該過濾器，而是所有日誌條目都有一個「_grokparsefailure」t股份公司。

有什麼想法可能是這裏的問題？我遵循了幾個指南，仍然有這個問題。

P.S. 我知道COMBINEDAPACHELOG，但我仍然想用我自己的經驗來解析它，並理解ELK堆疊擊球手。

來源

2016-08-04 Alex Zel

嘗試改變messege到message你神交比賽

  change 'e' to 'a' 
       | 
       v 
    match => ["message", "%{IP:client} - - \[%{HTTPDATE:event_date}\] %{QS:first} %{NUMBER:response} %{NUMBER:bytes} %{QS:destination} %{QS:browser}"]

來源

2016-08-05 05:26:14 Val

現在我只是覺得自己很蠢，感謝那個做到了！ –

Logstash不對Apache日誌應用過濾器

回答

相關問題