Chinaunix

标题: 日志正则匹配 [打印本页]

作者: 236848253 时间: 2016-02-29 17:39
标题: 日志正则匹配
小弟有个问题咨询一下：
Feb 29 17:26:16 sa2xxb002 sshd[17965]: Received disconnect from 192.168.13.137: 11: disconnected by user

以上这条linux的登陆日志，我用正则只能匹配到：之前，小弟请教，后半部分怎么匹配，求大牛们告知一下

作者: 我是一隻羊 时间: 2016-02-29 17:46
具体要匹配到哪一段啊?能把想匹配的内容也发一下吗

作者: jason680 时间: 2016-02-29 17:55
http://bbs.chinaunix.net/thread-4138810-1-1.html

作者: 236848253 时间: 2016-02-29 18:17
回复 2# 我是一隻羊

匹配 Received disconnect from 192.168.13.137: 11: disconnected by user

作者: 236848253 时间: 2016-02-29 18:24
回复 3# jason680

sorry，小弟问题没说清楚，小弟原日志

Feb 29 18:15:30 sa2liub002 sshd[21489]: Accepted publickey for shsuper from 192.168.13.137 port 55063 ssh2

现在通过grok match匹配如下：
"message" => [
      [0] "Feb 29 18:17:51 sa2liub002 sshd[21493]: Received disconnect from 192.168.13.137: 11: disconnected by user",
      [1] "Received disconnect from 192.168.13.137: 11: disconnected by user"
],
            "@version" => "1",
            "@timestamp" => "2016-02-29T10:17:51.950Z",
                  "host" => "sa2liub002",
                  "path" => "/var/log/secure",
                  "type" => "syslog",
            "timestamp" => "Feb 29 18:17:51",
            "logsource" => "sa2liub002",
               "program" => "sshd",
                  "pid" => "21493",
"syslog_severity_code" => 5,
"syslog_facility_code" => 1,
      "syslog_facility" => "user-level",
      "syslog_severity" => "notice"

但是Accepted publickey for shsuper from 192.168.13.137 port 55063 ssh2 这一部分不知道怎么去匹配。

作者: jason680 时间: 2016-02-29 18:46
http://kibana.logstash.es/content/logstash/plugins/filter/grok.html

作者: hz_oracle 时间: 2016-03-03 10:42
grep "192.168.13.137: 11" file | cut -d"[:" -f2

欢迎光临 Chinaunix (http://bbs.chinaunix.net/)