Grok 匹配七牛云日志数据到 ElasticSearch

介绍

• 好久没写 grok 规则匹配了，朋友让我帮忙匹配下。
• http://grokdebug.herokuapp.com/

1.1、测试数据

• 以下数据做了模糊处理

fragments/z1.aka.chat128646995/1219828062276-1619828018789.ts      807648  FfyegrtQSva9J2O2aEUyXZgO1hN7    16198280687884277       video/mp2ts   1
fragments/z1.aka.chat138646995/1219828068466-1619828014940.ts      822312  qmSvtkAm0iFqsAi66h9IQFcdewRZ    16198280750249496       video/mp2ts   1
fragments/z1.aka.chat148646995/1319828074161-1619828010094.ts      687704  Frr2HNfhlLpjQkI1vSs8kqbUaA58    16198280801968203       video/mp2ts   1
fragments/z1.aka.chat158646995/1319828080241-1619828016180.ts      801444  Fl8W0hLiZ8nAQs-mrnln3kIMX7wZ    16198280862329847       video/mp2ts   1
fragments/z1.aka.chat168646995/1219828086382-1619828012396.ts      835096  FlsKCHB83xQn2vpXxxLmLii_YLF5    16198280923908611       video/mp2ts   1

1.2、匹配规则

%{NOTSPACE:file_name}      %{USERNAME:size}  %{WORD:hash}    %{WORD:up_time}       %{NOTSPACE:file_type}   %{INT:user_id}

1.3、匹配结果

{
  "file_name": [
    [
      "fragments/z1.aka.chat128646995/1219828062276-1619828018789.ts"
    ]
  ],
  "size": [
    [
      "807648"
    ]
  ],
  "hash": [
    [
      "FfyegrtQSva9J2O2aEUyXZgO1hN7"
    ]
  ],
  "up_time": [
    [
      "16198280687884277"
    ]
  ],
  "file_type": [
    [
      "video/mp2ts"
    ]
  ],
  "user_id": [
    [
      "1"
    ]
  ]
}