请选择 进入手机版 | 继续访问电脑版
 找回密码
 立即注册
搜索

本文来自

安全运维工具

安全运维工具

人已关注

请添加对本版块的简短描述

精选帖子

视频点播和视频直播
视频点播和视频直播
0阅读|261人阅读
阿里云20180627故障初步分析
阿里云20180627故障初步分析
1阅读|614人阅读
ELK出现  vm.max_map_count [65530] is too low解决方法
ELK出现 vm.max_map_count [65530] is too
0阅读|457人阅读
快速搭建nginx
快速搭建nginx
0阅读|961人阅读

ELK 的 logstash patterns grok-patterns

[复制链接]
1130 abc 发表于 2018-6-13 16:59:36
  1. USERNAME [a-zA-Z0-9._-]+
  2. USER %{USERNAME}
  3. INT (?:[+-]?(?:[0-9]+))
  4. BASE10NUM (?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+)))
  5. NUMBER (?:%{BASE10NUM})
  6. BASE16NUM (?<![0-9A-Fa-f])(?:[+-]?(?:0x)?(?:[0-9A-Fa-f]+))
  7. BASE16FLOAT \b(?<![0-9A-Fa-f.])(?:[+-]?(?:0x)?(?:(?:[0-9A-Fa-f]+(?:\.[0-9A-Fa-f]*)?)|(?:\.[0-9A-Fa-f]+)))\b

  8. POSINT \b(?:[1-9][0-9]*)\b
  9. NONNEGINT \b(?:[0-9]+)\b
  10. WORD \b\w+\b
  11. NOTSPACE \S+
  12. SPACE \s*
  13. DATA .*?
  14. GREEDYDATA .*
  15. QUOTEDSTRING (?>(?<!\\)(?>"(?>\\.|[^\"]+)+"|""|(?>'(?>\\.|[^\\']+)+')|''|(?>`(?>\\.|[^\\`]+)+`)|``))
  16. UUID [A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}

  17. # Networking
  18. MAC (?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC})
  19. CISCOMAC (?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})
  20. WINDOWSMAC (?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2})
  21. COMMONMAC (?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})
  22. IPV6 ((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?
  23. IPV4 (?<![0-9])(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))(?![0-9])
  24. IP (?:%{IPV6}|%{IPV4})
  25. HOSTNAME \b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b)
  26. HOST %{HOSTNAME}
  27. IPORHOST (?:%{HOSTNAME}|%{IP})
  28. HOSTPORT %{IPORHOST}:%{POSINT}

  29. # paths
  30. PATH (?:%{UNIXPATH}|%{WINPATH})
  31. UNIXPATH (?>/(?>[\w_%!$@:.,-]+|\\.)*)+
  32. TTY (?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+))
  33. WINPATH (?>[A-Za-z]+:|\\)(?:\\[^\\?*]*)+
  34. URIPROTO [A-Za-z]+(\+[A-Za-z+]+)?
  35. URIHOST %{IPORHOST}(?::%{POSINT:port})?
  36. # uripath comes loosely from RFC1738, but mostly from what Firefox
  37. # doesn't turn into %XX
  38. URIPATH (?:/[A-Za-z0-9$.+!*'(){},~:;=@#%_\-]*)+
  39. #URIPARAM \?(?:[A-Za-z0-9]+(?:=(?:[^&]*))?(?:&(?:[A-Za-z0-9]+(?:=(?:[^&]*))?)?)*)?
  40. URIPARAM \?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]]*
  41. URIPATHPARAM %{URIPATH}(?:%{URIPARAM})?
  42. URI %{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?

  43. # Months: January, Feb, 3, 03, 12, December
  44. MONTH \b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\b
  45. MONTHNUM (?:0?[1-9]|1[0-2])
  46. MONTHNUM2 (?:0[1-9]|1[0-2])
  47. MONTHDAY (?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9])

  48. # Days: Monday, Tue, Thu, etc...
  49. DAY (?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)

  50. # Years?
  51. YEAR (?>\d\d){1,2}
  52. HOUR (?:2[0123]|[01]?[0-9])
  53. MINUTE (?:[0-5][0-9])
  54. # '60' is a leap second in most time standards and thus is valid.
  55. SECOND (?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)
  56. TIME (?!<[0-9])%{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9])
  57. # datestamp is YYYY/MM/DD-HH:MM:SS.UUUU (or something like it)
  58. DATE_US %{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR}
  59. DATE_EU %{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR}
  60. ISO8601_TIMEZONE (?:Z|[+-]%{HOUR}(?::?%{MINUTE}))
  61. ISO8601_SECOND (?:%{SECOND}|60)
  62. TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}?
  63. DATE %{DATE_US}|%{DATE_EU}
  64. DATESTAMP %{DATE}[- ]%{TIME}
  65. TZ (?:[PMCE][SD]T|UTC)
  66. DATESTAMP_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ}
  67. DATESTAMP_RFC2822 %{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE}
  68. DATESTAMP_OTHER %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR}
  69. DATESTAMP_EVENTLOG %{YEAR}%{MONTHNUM2}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND}

  70. # Syslog Dates: Month Day HH:MM:SS
  71. SYSLOGTIMESTAMP %{MONTH} +%{MONTHDAY} %{TIME}
  72. PROG (?:[\w._/%-]+)
  73. SYSLOGPROG %{PROG:program}(?:\[%{POSINT:pid}\])?
  74. SYSLOGHOST %{IPORHOST}
  75. SYSLOGFACILITY <%{NONNEGINT:facility}.%{NONNEGINT:priority}>
  76. HTTPDATE %{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT}

  77. # Shortcuts
  78. QS %{QUOTEDSTRING}

  79. # Log formats
  80. SYSLOGBASE %{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}:
  81. COMMONAPACHELOG %{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)
  82. COMBINEDAPACHELOG %{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}

  83. # Log Levels
  84. LOGLEVEL ([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)
复制代码


源文件地址:

游客,本帖隐藏的内容需要积分高于 1000 才可浏览,您当前积分为 0




回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

快速回复 返回顶部 返回列表