Telegraf:如何使用正则表达式处理器从字段中提取内容?

huangapple go评论75阅读模式
英文:

Telegraf: How to extract from field using regex processor?

问题

我想从这个输入中使用telegraf regex处理器插件提取连接、上游和下游的值:

2022/11/16 22:38:48 In the last 1h0m0s, there were 10 connections. Traffic Relayed ↑ 60 MB, ↓ 4 MB.

使用以下配置,结果键"upstream"是初始消息的副本,但没有"regexed"部分。

[[processors.regex]]
  tagpass = ["snowflake-proxy"]

  [[processors.regex.fields]]
    ## 要更改的字段
    key = "message"
    ## 在此处可用所有Go正则表达式的强大功能
    ## 例如,命名子组
    pattern = 'Relayed.{3}(?P<UPSTREAM>\d{1,4}\W.B),'
    replacement = "${UPSTREAM}"
    ## 如果存在result_key,将创建一个新字段
    ## 而不是更改现有字段
    result_key = "upstream"

当前输出:

2022/11/17 10:38:48 In the last 1h0m0s, there were 1 connections. Traffic 3 MB ↓ 5 MB.

如何获取小数部分?

我对如何在这里使用正则表达式感到有些困惑,因为在网上的几个示例中,它应该像这样工作。例如,请参阅:http://wiki.webperfect.ch/index.php?title=Telegraf:_Processor_Plugins

英文:

I would like to extract the values for connections, upstream and downstream using telegraf regex processor plugin from this input:

2022/11/16 22:38:48 In the last 1h0m0s, there were 10 connections. Traffic Relayed ↑ 60 MB, ↓ 4 MB.

Using this configuration the result key "upstream" is a copy of the initial message but without a part of the 'regexed' stuff.

[[processors.regex]]
  tagpass = [&quot;snowflake-proxy&quot;]

  [[processors.regex.fields]]
    ## Field to change
    key = &quot;message&quot;
    ## All the power of the Go regular expressions available here
    ## For example, named subgroups
    pattern = &#39;Relayed.{3}(?P&lt;UPSTREAM&gt;\d{1,4}\W.B),&#39;
    replacement = &quot;${UPSTREAM}&quot;
    ## If result_key is present, a new field will be created
    ## instead of changing existing field
    result_key = &quot;upstream&quot;

Current output:

2022/11/17 10:38:48 In the last 1h0m0s, there were 1 connections. Traffic 3 MB ↓ 5 MB.

How do I get the decimals?

I'm quite a bit confused how to use the regex here, because on several examples in the web it should work like this. See for example: http://wiki.webperfect.ch/index.php?title=Telegraf:_Processor_Plugins

答案1

得分: 1

替换配置选项指定了您想要替换的内容以匹配任何结果。

我认为您想要更接近以下内容:

  [[processors.regex.fields]]
    key = "message"
    pattern = '.*Relayed.{3}(?P<UPSTREAM>\d{1,4}\W.B),.*$'
    replacement = ""
    result_key = "upstream"

得到的结果应该是:

upstream="60 MB"
英文:

The replacement config option specifies what you want to replace in for any matches.

I think you want something closer to this:

  [[processors.regex.fields]]
    key = &quot;message&quot;
    pattern = &#39;.*Relayed.{3}(?P&lt;UPSTREAM&gt;\d{1,4}\W.B),.*$&#39;
    replacement = &quot;${1}&quot;
    result_key = &quot;upstream&quot;

to get:

upstream=&quot;60 MB&quot;

huangapple
  • 本文由 发表于 2022年11月17日 22:45:11
  • 转载请务必保留本文链接:https://go.coder-hub.com/74477375.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定