用\r\n作为字段分割(反斜杠)-Logstashkvfilterissuewith\r\nasfieldsplit(backslash)

I'm trying to parse this logs line using kv

我尝试用kv来解析这个日志。

Host: mobile.bpifrance.fr\r\nConnection: keep-alive\r\nAccept: application/json, text/plain, */*\r\nUser-Agent: Mozilla/5.0 (Linux; Android 5.0.2; SM-G901F Build/LRX22G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Crosswalk/IP.IP.IP.IP Mobile Safari/537.36\r\nAccept-Encoding: gzip, deflate\r\nAccept-Language: fr-fr\r\nCOOKIE: MRHSHint=deleted; XXXX=1z1z1z1452251835z14400; LastMRH_Session=0175d881; JSESSIOnID=836A243928E475506091D32FB585D812; TDF=123456.789.1000; TDF=123456.789.1000; TS01748689=01450ecb576c294567faa529b12c3299cf27b272dc5d54fe2c1f98fca83fc436733ad811cd33162b0ce794a6658d86242d07407c8a\r\nX-Forwarded-For: IP.IP.IP.IP\r\nX-Forwarded-Remote-User: xxxx\r\nsession-id: 0175d881\r\nsession-key: 6ab68177c496ec366d5c45240175d881\r\nusername: xxxx\r\n\r\n

I've tried several configurations with kv and always got stranger behavior.

我尝试过几种与kv的配置，并且总是有陌生人的行为。

The most logical configuration for me is to do something like that:

对我来说，最合理的配置是:

field_split => "(\\\r\\\n)"

I've tried field_split with (\\\\\\\\\r\\\\\\\\\n), (\\\\)r(\\\\)n, (?\\\\)r{1}(?\\\\)n{1} and got no result.

我试着field_split(\ \ \ \ \ \ \ \ \ r \ \ \ \ \ \ \ \ \ n),(\ \ \ \)r(\ \ \ \)n,r(? \ \ \ \){ 1 }(? \ \ \ \)n { 1 },但是毫无结果。

I have also tried mutate gsub and got the same issues.

我也尝试了mutate gsub，并得到了同样的问题。

Any suggestions?

有什么建议吗?

Many thanks

非常感谢

1 个解决方案

filter {
  mutate {
    gsub => [ "message", "[\\\\]r", "somestring" ]
    gsub => [ "message", "[\\\\]n", "somestring" ]
  }
}
filter {
  ruby {
    code => "begin; event['message'] = event['message'].split(/somestringsomestring/); rescue Exception; end"
  }
}
filter {
  if [type] == "XXX" {
    kv {
      field_split => "\n"
      value_split => ":"
      source => "message"
    }
  }
}