日志正则匹配

236848253

小弟有个问题咨询一下：
Feb 29 17:26:16 sa2xxb002 sshd[17965]: Received disconnect from 192.168.13.137: 11: disconnected by user

以上这条linux的登陆日志，我用正则只能匹配到：之前，小弟请教，后半部分怎么匹配，求大牛们告知一下

我是一隻羊

具体要匹配到哪一段啊?能把想匹配的内容也发一下吗

jason680

http://bbs.chinaunix.net/thread-4138810-1-1.html

236848253

回复 2# 我是一隻羊


    匹配  Received disconnect from 192.168.13.137: 11: disconnected by user

236848253

回复 3# jason680


sorry，小弟问题没说清楚，小弟原日志

Feb 29 18:15:30 sa2liub002 sshd[21489]: Accepted publickey for shsuper from 192.168.13.137 port 55063 ssh2

现在通过grok match匹配如下：
"message" => [
        [0] "Feb 29 18:17:51 sa2liub002 sshd[21493]: Received disconnect from 192.168.13.137: 11: disconnected by user",
        [1] "Received disconnect from 192.168.13.137: 11: disconnected by user"
    ],
                "@version" => "1",
              "@timestamp" => "2016-02-29T10:17:51.950Z",
                    "host" => "sa2liub002",
                    "path" => "/var/log/secure",
                    "type" => "syslog",
               "timestamp" => "Feb 29 18:17:51",
               "logsource" => "sa2liub002",
                 "program" => "sshd",
                     "pid" => "21493",
    "syslog_severity_code" => 5,
    "syslog_facility_code" => 1,
         "syslog_facility" => "user-level",
         "syslog_severity" => "notice"

但是Accepted publickey for shsuper from 192.168.13.137 port 55063 ssh2 这一部分不知道怎么去匹配。

jason680

http://kibana.logstash.es/content/logstash/plugins/filter/grok.html

hz_oracle

grep  "192.168.13.137: 11" file | cut -d"[:" -f2