question Logstash avec config regex

Question

J'ai l'entrée du journal suivant:

2017-08-29 01:10:11.111 [http-noo-111-exe-1] TRACE com.javasystemsolutions.xml.gateway.Actions - The XML Gateway encountered an error. The message was Server with id OPA is not configured. 

The template in use was TEST_Create_Incident_elkmonitoring. 

The server in use was OPA. 

The input XML was <incident> 
     <summary>Test Monitoring - Summary</summary> 
     <notes>Test Monitoring - Summary</notes> 
     <product>ELK FAQ</product> </incident> com.javasystemsolutions.xml.gateway.ServerNotFoundException: Server with id OPA is not configured 
     at com.javasystemsolutions.xml.gateway.input.PostActions.doPost(PostActions.java:215) [jss-xmlgateway.jar:?] 
     at com.javasystemsolutions.xml.gateway.input.PostActions.postAction(PostActions.java:86) [jss-xmlgateway.jar:?] 

Ce que je suis en train de le faire, est d'utiliser regex et identifier le texte entre les balises d'incidents, mais comme il semble que quelque chose est faux Bien que mon expression régulière fonctionne sur le site Web regex101 et le configtest renvoie la configuration OK. Ma config est celle ci-dessous, est-ce que quelqu'un a une idée de ce qui ne va pas?

# The # character at the beginning of a line indicates a comment. Use 
# comments to describe your configuration. 
input { 
    file { 
     type => "logs" 
     path => "C:/logs/*.log" 
     add_field => [ "Application", "ELK_GW_Test" ] 
     add_field => [ "secret", "1234" ] 
     start_position => beginning 

     codec => multiline { 
      pattern => "(^%{TIMESTAMP_ISO8601})" 
      #negate => true 
      what => "previous" 
     } 
    } 
} 
filter { 
    #multiline { 
     #pattern => "(^%{TIMESTAMP_ISO8601})" 
     #negate => true 
     #what => "previous" 
    #} 
    #if "_grokparsefailure" in [tags] { 
     #drop { } 
    #} 
    if [host] == "host1" { 
     grok { 
      match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE} %{LOGLEVEL:Severity} %{GREEDYDATA:log_message}"} 
     } 
     grok { 
     match => {"message" => "<incident>(?<incident>[\s\S]*)</incident>"} 
    } 
    } 
} 
output { 
    tcp { 
     host => "host1.com" 
     port => 1234 
     codec => "json_lines" 
    } 
    #if "The message was Server with id " in [log_message] { 
    #email { 
      #from => "log-mailer@XYZ.com" 
      #subject => "Central logstash alert" 
      #to => "my_email@ABC.com" 
      #via => "smtp" 
      #body => "The incident details are: %{incident} \nLog file: %{path}" 
      #options => { 
       #starttls => "true" 
       #smtpIporHost => "email.XYZ.com" 
       #port => "587" 
       #userName => "log-mailer@XYZ.com" 
       # email-server-mail-id 
       # password => "password" 
       #authenticationType => "LOGIN" 
      #} 
     #} 
    #} 
} 

Answer 1

Cette partie de la configuration est erronée:

grok { 
     match => ["requested_incident", "(?s)<incident>.+?</incident>"] 
    } 

Essayez ceci:

grok { 
     match => {"message" => "<incident>(?<incident>[\s\S]*)</incident>"} 
    } 

Je l'ai utilisé un modèle personnalisé, qui recherche dans le champ de message. Ce qui est trouvé ira dans un champ appelé incident.