英文:
Telegraf: How to extract from field using regex processor?
问题
我想从这个输入中使用telegraf regex处理器插件提取连接、上游和下游的值:
2022/11/16 22:38:48 In the last 1h0m0s, there were 10 connections. Traffic Relayed ↑ 60 MB, ↓ 4 MB.
使用以下配置,结果键"upstream"是初始消息的副本,但没有"regexed"部分。
[[processors.regex]]
tagpass = ["snowflake-proxy"]
[[processors.regex.fields]]
## 要更改的字段
key = "message"
## 在此处可用所有Go正则表达式的强大功能
## 例如,命名子组
pattern = 'Relayed.{3}(?P<UPSTREAM>\d{1,4}\W.B),'
replacement = "${UPSTREAM}"
## 如果存在result_key,将创建一个新字段
## 而不是更改现有字段
result_key = "upstream"
当前输出:
2022/11/17 10:38:48 In the last 1h0m0s, there were 1 connections. Traffic 3 MB ↓ 5 MB.
如何获取小数部分?
我对如何在这里使用正则表达式感到有些困惑,因为在网上的几个示例中,它应该像这样工作。例如,请参阅:http://wiki.webperfect.ch/index.php?title=Telegraf:_Processor_Plugins
英文:
I would like to extract the values for connections, upstream and downstream using telegraf regex processor plugin from this input:
2022/11/16 22:38:48 In the last 1h0m0s, there were 10 connections. Traffic Relayed ↑ 60 MB, ↓ 4 MB.
Using this configuration the result key "upstream" is a copy of the initial message but without a part of the 'regexed' stuff.
[[processors.regex]]
tagpass = ["snowflake-proxy"]
[[processors.regex.fields]]
## Field to change
key = "message"
## All the power of the Go regular expressions available here
## For example, named subgroups
pattern = 'Relayed.{3}(?P<UPSTREAM>\d{1,4}\W.B),'
replacement = "${UPSTREAM}"
## If result_key is present, a new field will be created
## instead of changing existing field
result_key = "upstream"
Current output:
2022/11/17 10:38:48 In the last 1h0m0s, there were 1 connections. Traffic 3 MB ↓ 5 MB.
How do I get the decimals?
I'm quite a bit confused how to use the regex here, because on several examples in the web it should work like this. See for example: http://wiki.webperfect.ch/index.php?title=Telegraf:_Processor_Plugins
答案1
得分: 1
替换配置选项指定了您想要替换的内容以匹配任何结果。
我认为您想要更接近以下内容:
[[processors.regex.fields]]
key = "message"
pattern = '.*Relayed.{3}(?P<UPSTREAM>\d{1,4}\W.B),.*$'
replacement = ""
result_key = "upstream"
得到的结果应该是:
upstream="60 MB"
英文:
The replacement config option specifies what you want to replace in for any matches.
I think you want something closer to this:
[[processors.regex.fields]]
key = "message"
pattern = '.*Relayed.{3}(?P<UPSTREAM>\d{1,4}\W.B),.*$'
replacement = "${1}"
result_key = "upstream"
to get:
upstream="60 MB"
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库,让每个人都能够通过互相帮助和分享经验来进步。
评论