Logstash grok过滤器，用于标记退回的邮件

uqdfh47h 于 2022-12-09 发布在 Logstash

关注(0)|答案(2)|浏览(207)

总结：我有一些出站smtp服务器，并通过rsyslog将邮件日志集中到我正在使用logstash的服务器上，输出到elasticsearch，用kibana搜索。
我想将Postfix邮件日志条目标记为“BOUNTED”，例如：

2013-02-01T16:50:14+02:00 XXSMTPXX postfix/smtp[10879]: BC54A65BD4: to=<xxxx.yyyyyy@zzzz.com.t>, relay=none, delay=0.3, delays=0.01/0/0.29/0, dsn=5.4.4, status=bounced (Host or domain name not found. Name service error for name=gozdesigorta.com.t type=AAAA: Host not found)

我在logstash.conf中使用的grok过滤器如下所示：

grok {
    patterns_dir => "/etc/logstash/patterns"
    tags    => "postfix/bounce"
    pattern => "%{POSTFIXBOUNCE}"
    add_tag => "BOUNCED"
    named_captures_only => true
}

我使用的病毒码文件是https://gist.github.com/4691822
我无法设法将这些日志行标记为“已跳出”...我错过了什么？

logstash

来源：https://stackoverflow.com/questions/14649230/logstash-grok-filter-to-tag-bounced-messages

2条答案

按热度按时间

hmmo2u0o1#

我把图案改成：

%{TIMESTAMP_ISO8601} %{HOST} %{SYSLOGPROG}: %{QUEUEID}: to=<%{EMAILADDRESS:to}>, relay=%{RELAY}, delay=%{POSREAL:delay}, delays=%{DELAYS}, dsn=%{DSN}, status=%{STATUS} %{GREEDYDATA:reason}

现在我可以摸索;）

赞(0）回复(0）举报 2022-12-09

x6492ojm2#

你能粘贴完整的logstash.conf吗？我得到以下错误：

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \\t\\r\\n], \"#\", \"=>\" at line 20, column 19 (byte 558) after filter {        \n  grok {\n      patterns_dir => \"/etc/logstash/conf.d/patterns\"\n      tags    => \"postfix/bounce\"\n      pattern => \"%{POSTFIXBOUNCE}\"\n      add_tag => \"%{TIMESTAMP_ISO8601} %{HOST} %{SYSLOGPROG}: %{QUEUEID}: to=<%{EMAILADDRESS:to}>, relay=%{RELAY}, delay=%{POSREAL:delay}, delays=%{DELAYS}, dsn=%{DSN}, status=%{STATUS} %{GREEDYDATA:reason}\"\n      named_captures_only => true\n  }\n\noutput {\n    elasticsearch ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:189:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:383:in `block in converge_state'"]}

赞(0）回复(0）举报 2022-12-09

我来回答

Logstash grok过滤器，用于标记退回的邮件

2条答案

相关问题

热门标签

最新问答