logstash patterns github
USERNAME [a-zA-Z0-9._-]+ |
USER %{USERNAME} |
INT (?:[+-]?(?:[0-9]+)) |
BASE10NUM (?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+))) |
NUMBER (?:%{BASE10NUM}) |
BASE16NUM (?<![0-9A-Fa-f])(?:[+-]?(?:0x)?(?:[0-9A-Fa-f]+)) |
BASE16FLOAT \b(?<![0-9A-Fa-f.])(?:[+-]?(?:0x)?(?:(?:[0-9A-Fa-f]+(?:\.[0-9A-Fa-f]*)?)|(?:\.[0-9A-Fa-f]+)))\b |
POSINT \b(?:[1-9][0-9]*)\b |
NONNEGINT \b(?:[0-9]+)\b |
WORD \b\w+\b |
NOTSPACE \S+ |
SPACE \s* |
DATA .*? |
GREEDYDATA .* |
QUOTEDSTRING (?>(?<!\\)(?>"(?>\\.|[^\\"]+)+"|""|(?>'(?>\\.|[^\\']+)+')|''|(?>`(?>\\.|[^\\`]+)+`)|``)) |
UUID [A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12} |
# Networking |
MAC (?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC}) |
CISCOMAC (?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4}) |
WINDOWSMAC (?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2}) |
COMMONMAC (?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2}) |
IPV6 ((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)? |
IPV4 (?<![0-9])(?:(?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2})[.](?:25[0-5]|2[0-4][0-9]|[0-1]?[0-9]{1,2}))(?![0-9]) |
IP (?:%{IPV6}|%{IPV4}) |
HOSTNAME \b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*(\.?|\b) |
HOST %{HOSTNAME} |
IPORHOST (?:%{HOSTNAME}|%{IP}) |
HOSTPORT %{IPORHOST}:%{POSINT} |
# paths |
PATH (?:%{UNIXPATH}|%{WINPATH}) |
UNIXPATH (?>/(?>[\w_%!$@:.,-]+|\\.)*)+ |
TTY (?:/dev/(pts|tty([pq])?)(\w+)?/?(?:[0-9]+)) |
WINPATH (?>[A-Za-z]+:|\\)(?:\\[^\\?*]*)+ |
URIPROTO [A-Za-z]+(\+[A-Za-z+]+)? |
URIHOST %{IPORHOST}(?::%{POSINT:port})? |
# uripath comes loosely from RFC1738, but mostly from what Firefox |
# doesn't turn into %XX |
URIPATH (?:/[A-Za-z0-9$.+!*'(){},~:;=@#%_\-]*)+ |
#URIPARAM \?(?:[A-Za-z0-9]+(?:=(?:[^&]*))?(?:&(?:[A-Za-z0-9]+(?:=(?:[^&]*))?)?)*)? |
URIPARAM \?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?\-\[\]]* |
URIPATHPARAM %{URIPATH}(?:%{URIPARAM})? |
URI %{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})? |
# Months: January, Feb, 3, 03, 12, December |
MONTH \b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\b |
MONTHNUM (?:0?[1-9]|1[0-2]) |
MONTHNUM2 (?:0[1-9]|1[0-2]) |
MONTHDAY (?:(?:0[1-9])|(?:[12][0-9])|(?:3[01])|[1-9]) |
# Days: Monday, Tue, Thu, etc... |
DAY (?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?) |
# Years? |
YEAR (?>\d\d){1,2} |
HOUR (?:2[0123]|[01]?[0-9]) |
MINUTE (?:[0-5][0-9]) |
# '60' is a leap second in most time standards and thus is valid. |
SECOND (?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?) |
TIME (?!<[0-9])%{HOUR}:%{MINUTE}(?::%{SECOND})(?![0-9]) |
# datestamp is YYYY/MM/DD-HH:MM:SS.UUUU (or something like it) |
DATE_US %{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR} |
DATE_EU %{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR} |
ISO8601_TIMEZONE (?:Z|[+-]%{HOUR}(?::?%{MINUTE})) |
ISO8601_SECOND (?:%{SECOND}|60) |
TIMESTAMP_ISO8601 %{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}? |
DATE %{DATE_US}|%{DATE_EU} |
DATESTAMP %{DATE}[- ]%{TIME} |
TZ (?:[PMCE][SD]T|UTC) |
DATESTAMP_RFC822 %{DAY} %{MONTH} %{MONTHDAY} %{YEAR} %{TIME} %{TZ} |
DATESTAMP_RFC2822 %{DAY}, %{MONTHDAY} %{MONTH} %{YEAR} %{TIME} %{ISO8601_TIMEZONE} |
DATESTAMP_OTHER %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{TZ} %{YEAR} |
DATESTAMP_EVENTLOG %{YEAR}%{MONTHNUM2}%{MONTHDAY}%{HOUR}%{MINUTE}%{SECOND} |
# Syslog Dates: Month Day HH:MM:SS |
SYSLOGTIMESTAMP %{MONTH} +%{MONTHDAY} %{TIME} |
PROG (?:[\w._/%-]+) |
SYSLOGPROG %{PROG:program}(?:\[%{POSINT:pid}\])? |
SYSLOGHOST %{IPORHOST} |
SYSLOGFACILITY <%{NONNEGINT:facility}.%{NONNEGINT:priority}> |
HTTPDATE %{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT} |
# Shortcuts |
QS %{QUOTEDSTRING} |
# Log formats |
SYSLOGBASE %{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{SYSLOGHOST:logsource} %{SYSLOGPROG}: |
COMMONAPACHELOG %{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) |
COMBINEDAPACHELOG %{COMMONAPACHELOG} %{QS:referrer} %{QS:agent} |
# Log Levels |
LOGLEVEL ([Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo|INFO|[Ww]arn?(?:ing)?|WARN?(?:ING)?|[Ee]rr?(?:or)?|ERR?(?:OR)?|[Cc]rit?(?:ical)?|CRIT?(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|EMERG(?:ENCY)?|[Ee]merg(?:ency)?)
https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns
logstash patterns github的更多相关文章
- 日志分析(二) logstash patterns
grok-patterns内置了很多基础变量的正则表达式的log解析规则,其中包括apache的log解析(同样可以用于nginx的log解析). 基于nginx日志分析配置: 1.配置nginx ...
- logstash filter grok 用法
在elk+filebeat都安装好,且明白了基本流程后,主要的就是写logstash的filter了,以此来解析特定格式的日志 logstash的filter是用插件实现的,grok是其中一个,用来解 ...
- 使用ELK(Elasticsearch + Logstash + Kibana) 搭建日志集中分析平台实践--转载
原文地址:https://wsgzao.github.io/post/elk/ 另外可以参考:https://www.digitalocean.com/community/tutorials/how- ...
- logstash的各个场景应用(配置文件均已实践过)
场景: 1) datasource->logstash->elasticsearch->kibana 2) datasource->filebeat->logstash- ...
- CentOS 6.x ELK(Elasticsearch+Logstash+Kibana)
CentOS 6.x ELK(Elasticsearch+Logstash+Kibana) 前言 Elasticsearch + Logstash + Kibana(ELK)是一套开源的日志管理方案, ...
- elasticsear+kibana+logstash 优化
##关于s2安装cerebro来可视化集群管理##### https://blog.csdn.net/RWSLR6/article/details/79648767 https://github.co ...
- Logstash的filter插件介绍
一 官网说明 过滤器插件对事件执行中介处理.通常根据事件的特征有条件地应用过滤器. 以下过滤器插件在下面可用. Plugin Description Github repository aggrega ...
- 论logstash的玩法(ELK)
本篇文章采用的采用的是logstash-7.7.0版本,主要从如下几个方面介绍 1.logstash是什么,可以用来干啥 2.logstash的基本原理是什么 3.怎么去玩这个elk的组件logsta ...
- logstash -grok插件语法介绍
介绍 logstash拥有丰富的filter插件,它们扩展了进入过滤器的原始数据,进行复杂的逻辑处理,甚至可以无中生有的添加新的 logstash 事件到后续的流程中去!Grok 是 Logsta ...
随机推荐
- 如何把GitHub中的开源项目导入到Eclipse
准备: 1.需要注册GitHub的账号,并找到自己想导入的项目 2.在Eclipse的help-->Marketplace中搜索egit插件,然后安装 操作步骤: 1.有三种导入方式HTTP.S ...
- BZOJ1048:[HAOI2007]分割矩阵(记忆化搜索DP)
Description 将一个a*b的数字矩阵进行如下分割:将原矩阵沿某一条直线分割成两个矩阵,再将生成的两个矩阵继续如此分割(当然也可以只分割其中的一个), 这样分割了(n-1)次后,原矩阵被分割成 ...
- ssti记录
先看个python沙箱: #!/usr/bin/env python from __future__ import print_function print("Welcome to my P ...
- Project Euler:Problem 86 Cuboid route
A spider, S, sits in one corner of a cuboid room, measuring 6 by 5 by 3, and a fly, F, sits in the o ...
- JavaScript前端将时间戳转换为日期格式
function (data) { var date = new Date(data) var Y = date.getFullYear() + '-' var M = (date.getMonth( ...
- Page Object 设计模式-PO
1.传统测试用例实现的弊端: 易读性差 复用性差 可维护性差 扩展性差 2.PO 设计模式图: 3.Page Object 的核心要素: 抽象封装一个 BasePage 基类,基类应该拥有一个只想 w ...
- DBCP数据库连接池的简单使用
0.DBCP简介 DBCP(DataBase connection pool)数据库连接池是 apache 上的一个Java连接池项目.DBCP通过连接池预先同数据库建立一些连接放在内存中( ...
- java实现zabbix接口开发
API:https://www.zabbix.com/documentation/4.0/zh/manual/api/reference/user/login 如果你使用jar包开发的话,会出现*** ...
- Windows 安装 MySQL 8.0.11
下载并解压 从官方网站下载最新安装包 解压到目标安装目录 新建配置文件 在安装目录新建my.ini文件 添加如下内容(需修改为自己的配置) #----------------------------- ...
- 虚拟机重启网络服务失败,当查看状态显示错误Failed to start LSB......
重启网络失败截图 从本质上来看出现这样的问题,是因为拷贝过来的虚拟机重新分配了网卡MAC地址.这样造成的结果是配置文件中MAC与当前网卡MAC不一致.所以只需要修改一下配置文件即可. 用ip addr ...