[2020-05-05T04:27:54.668Z] "GET /click?ab_tst_bckt=-1&dvc_id=IddFVZ8W--0nuPg9P31T&featured=99&hasOfferId=1120&impressionId=NgnMfW7bYb&page_type=Search&paymentType=cpc&placement=ratetable&position=1&rf=https%3A%2F%2Fwww.ratecity.com.au%2Fcar-loans%2Flow-interest&uuid=1abb33fc-e6cd-45c6-94de-44291dfb2871&vertical=car-loans HTTP/1.1" 200 - "-" "-" 0 11971 17 17 "2001:8003:d576:b100:984a:21b6:d74e:67c7, 2001:8003:d576:b100:984a:21b6:d74e:67c7,54.206.38.58,192.168.73.159" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.113 Safari/537.36" "d3632811-e50e-4686-9985-9d10d78e75ba" "swift.ratecity.com.au" "127.0.0.1:4444" inbound|4444|http|swift-client.ratecity.svc.cluster.local - 192.168.13.129:4444 192.168.73.159:0 -
有没有一个grok模式已经可以用于这个envoyproxy日志？
我在kibana上使用调试器，到现在为止，需要帮助我完成这个工作。
\[%{GREEDYDATA:timestamp}\] \"%{WORD:method} %{URIPATH:request} ?%{URIPARAM:url_params} %{URIPROTO:protocol}/%{NUMBER:httpversion}" %{NUMBER:response} - "-" "-" %{GREEDYDATA:flags} %{IP:client_ip}(,\\s%{IP})*
这里是Grok模式，你可以在将envoyproxy日志保存到elasticsearch索引之前对其进行预处理。
"""\[%{GREEDYDATA:istio.timestamp}\] \"%{WORD:istio.method} %{URIPATH:istio.request}(?:%{URIPARAM:istio.url_params}|-)? %{URIPROTO:istio.protocol}/%{NUMBER:istio.httpversion}\" %{NUMBER:istio.response} (?<istio.response_flag>%{DATA}|-)? \"-\" \"-\" %{NUMBER:istio.bytes_received} %{NUMBER:istio.bytes_sent} %{NUMBER:istio.duration} (?<istio.service_time>%{NUMBER}|-)? \"(?<istio.x_forwarded_for>%{IP:istio.client_ip},%{SPACE}.+?(?=")|-)\" \"(?<istio.user_agent>%{DATA}.+?(?=")|-)\"?"""