Logstash：配置汇总+过滤器经过

问题描述

我有这些日志：

"03.08.2020 10:56:38","Event LClick","Type Menu","t=0","beg"
"03.08.2020 10:56:38","Detail SomeDetail","t=109","end"
"03.08.2020 10:56:40","t=1981","beg"
"03.08.2020 10:56:40","t=2090","end"
"03.08.2020 10:56:41","Type ToolBar","t=3026","beg"
"03.08.2020 10:56:43","Detail User_Desktop","t=4477","end"
"03.08.2020 10:56:44","Event FormActivate","Name Form_Name:IsaA","t=5444"
"03.08.2020 10:56:51","t=12543","beg"
"03.08.2020 10:56:51","t=12605","end"
"03.08.2020 10:56:52","Form ","Type Label","Name Application.for.training","t=13853","beg"
"03.08.2020 10:57:54","Form Application.for.training","t=75442","end"
"03.08.2020 10:57:54","Name List.form","t=75785"
"03.08.2020 10:58:04","Event Wheel","Form List.form","Type FormTable","Name Список","t=85769","beg"
"03.08.2020 10:58:04","end"
"03.08.2020 10:58:04","t=85847","t=85879","t=85925","end"
"03.08.2020 10:58:08","t=89373","beg"
"03.08.2020 10:58:08","Detail Data","t=89451","end"
"03.08.2020 10:58:15","t=96580","beg"
"03.08.2020 10:58:15","t=96643","Event LBtnDbl","t=96752","beg"
"03.08.2020 10:59:22","Name Another.Form","t=164004"
"03.08.2020 10:59:22","Form Another.Form","t=164004","end"
"03.08.2020 10:59:25","Name КоманднаяПанельПереченьРеквизитов","t=167171","beg"
"03.08.2020 10:59:26","Detail Заполнить","t=167249","end"
...

我的logstash配置：

input {
    beats {
        port => '5044'
    }
}
 filter {
    grok {
        patterns_dir => ['./patterns']
        match => { 'message' => '%{TIME:timestamp}(","Event\s)(?<Event>([^"]+))(","Form\s)?(?<Form>([^"]+))?(","ParentType\s)?(?<parent_type>([^"]+))?(","ParentName\s)?(?<parent_name>([^"]+))?(","Type\s)?(?<type>([^"]+))?(","Name\s)?(?<Name_of_form>([^"]+))?(","Detail\s)?(?<Detail>([^"]+))?(","t=)?(?<t>([\d]+))?(",")?(?<Status>(end|beg))?' }
        add_tag => [ '%{Status}' ]
    }
    dissect {
        mapping => {
            '[log][file][path]' => 'C:\Program Files\Filebeat\logs\%{somethingtoo}\%{something}\%{user}\%{filename}.txt'
        }
    }
    date {
        match => [ 'timestamp','dd.MM.yyyy HH:mm:ss' ]
    }
    elapsed {
        unique_id_field => 'Event'
        start_tag => 'beg'
        end_tag => 'end'
        new_event_on_match => false
    }

    if 'elapsed' in [tags] {
        aggregate {
            task_id => '%{Event}'
            code => 'map["duration"] = [(event.get("elapsed_time")*1000).to_i]'
            map_action => 'create'
        }
    }
    mutate {
        remove_field => ['timestamp','ecs','log','tags','message','@version','something','somethingtoo','filename','input','host','agent','t','parent_type','parent_name','type']
        rename => {'elapsed_time' => 'Event_duration'}
    }
}
output {
    elasticsearch {
        hosts => ['localhost:9200']
        index => 'test'
    }
}

问题：现在，我使用beg（动作的开始）和end（动作的结束）来计算行之间的时间差。但这没有多大意义，因为它几乎总是0秒。我将如何实现它：当表单字段出现在行中（如果消息中为“ Form”）时，请考虑某个表单的第一个外观与最后一个外观之间的区别。如果不清楚将end_tag绑定到什么，该如何实现。

对于上面的日志，我应该得到以下内容：

1. 某些表单已被激活（Event FormActivate），处于单独的字段表单名称（名称Name_of_form）中。然后，执行此表单的操作（必须计算其时间），然后激活新表单，依此类推，直到文件结束。
2. 只要形式相同。继续前进。
3. 此表格的最后一次出现
4. 经过时间：“ 08/03/2020 10:58:15”-“ 08/03/2020 10:58:04” = 11秒

我将非常感谢您的帮助！

解决方法

暂无找到可以解决该程序问题的有效方法，小编努力寻找整理中！

如果你已经找到好的解决方法，欢迎将解决方案带上本链接一起发送给小编。

小编邮箱:dio#foxmail.com (将#修改为@）