Mysql 利用multiline 实现多行匹配

<pre name="code" class="html">input {
        file {
                type => "zj_mysql"
                path => ["/data01/applog_backup/zjzc_log/zj-mysql01-slowlog.*"]
        }

       file {
                type => "wj_mysql"
                path => ["/data01/applog_backup/winfae_log/wj-mysql01-slowlog.*"]
        } 

    }

filter {

   multiline {
               pattern =>"^\s+#\s+Time:"
               negate=>true
               what=>"previous"
         }
 }

output {
     if [type] == "zj_mysql" {
        redis {
                host => "192.168.32.67"
                data_type => "list"
                key => "zj_mysql:redis"
                port=>"6379"
                password => "1234567"
        }
}
      else if [type] == "wj_mysql"{
       redis {
                host => "192.168.32.67"
                data_type => "list"
                key => "wj_mysql:redis"
                port=>"6379"
                password => "1234567"
        }
}
}

multiline 多行匹配:

这个插件很简单,就是把当前行的数据添加到前面一行后面,直到新进的当前行匹配^# Time:正则为止。

看下slow log日志；

LIMIT 0, 50;
 # Time: 160826 14:56:36
 # User@Host: zjzc_dba[zjzc_dba]
 # Query_time: 8.897828  Lock_time: 0.000263 Rows_sent: 1  Rows_examined: 25721574
 SET timestamp=1472194596;
 SELECT (SUM(repay.`yieldBalance`)-SUM(TRUNCATE(holding.`investBalance`*stock.productYield*pr.duration/pr.daysOfYear,pr.`precision`))) AS totalAddBenefit
 			FROM GambleStockIndex stock
 			INNER JOIN `Product` po ON po.sn = stock.productSn
 			INNER JOIN ProductRepay pr on po.sn = pr.productSn
 			INNER JOIN `ClientInvestOrder` co ON co.`orderNo` = stock.`orderNo`
 			INNER JOIN `ClientProductHolding` holding ON holding.`investSn` = co.`sn`
 			INNER JOIN `ProductRepayment` repay ON repay.`holdingSn` = holding.`sn`
 		WHERE stock.`status`=2 and po.status =5
 LIMIT 0, 50;
 # Time: 160826 15:17:06
 # User@Host: zjzc_dba[zjzc_dba] @  [115.236.160.83]  Id: 5534343
 # Query_time: 8.842579  Lock_time: 0.000178 Rows_sent: 1  Rows_examined: 25721574
 SET timestamp=1472195826;
 SELECT (SUM(repay.`yieldBalance`)-SUM(TRUNCATE(holding.`investBalance`*stock.productYield*pr.duration/pr.daysOfYear,pr.`precision`))) AS totalAddBenefit
 			FROM GambleStockIndex stock
 			INNER JOIN `Product` po ON po.sn = stock.productSn
 			INNER JOIN ProductRepay pr on po.sn = pr.productSn
 			INNER JOIN `ClientInvestOrder` co ON co.`orderNo` = stock.`orderNo`
 			INNER JOIN `ClientProductHolding` holding ON holding.`investSn` = co.`sn`
 			INNER JOIN `ProductRepayment` repay ON repay.`holdingSn` = holding.`sn`
 		WHERE stock.`status`=2 and po.status =5
 LIMIT 0, 50;