regex - 为TD代理编写正则表达式

Question

当前，我们为syslog tdagent(fluentd)配置使用以下配置，并想为优先级创建另一个字段:我的日志错误。
我怎样才能做到这一点？

日志:

Nov 11 00:18:57 Build01v nagios: SERVICE ALERT: mmj21;Dropwizard MMJ Thread Pool;UNKNOWN;SOFT;1;**Error**: unable to access dropwizard metrics at localhost using port 8001

当前配置:

<source>
  @type tail
    path           /var/log/messages
    pos_file       /var/log/td-agent/var_log_messages.pos
    read_from_head true
    tag            /var/log/messages
    <parse>
      @type regexp
        expression  ^(?<time>[^ ]* [^ ]* [^ ]*) (?<host>[^ ]*) (?<process>[^ ]*): (?<message>.*)$
        time_format %b %d %H:%M:%S
        time_key    time
    </parse>
</source>

输出:

https://fluentular.herokuapp.com/parse?regexp=%5E%28%3F%3Ctime%3E%5B%5E+%5D*+%5B%5E+%5D*+%5B%5E+%5D*%29+%28%3F%3Chost%3E%5B%5E+%5D*%29+%28%3F%3Cprocess%3E%5B%5E+%5D*%29%3A+%28%3F%3Cmessage%3E.*%29%24&input=Nov+11+00%3A18%3A57+Build01v+nagios%3A+SERVICE+ALERT%3A+mmj21%3BDropwizard+MMJ+Thread+Pool%3BUNKNOWN%3BSOFT%3B1%3B**Error%3A**+unable+to+access+dropwizard+metrics+at+localhost+using+port+8001&time_format=%25b+%25d+%25H%3A%25M%3A%25S

记录

Key     Value
host    Build01v
process nagios
message SERVICE ALERT: mmj21;Dropwizard MMJ Thread Pool;UNKNOWN;SOFT;1;**Error:** unable to access dropwizard metrics at localhost using port 8001

Answer 1

我猜也许

^(?<time>\S* \S* \S*) (?<host>\S*) (?<process>[^:]*): (?<priority>[^:]*):(?<message>.*)$

可能就是您要编写的内容。
RegEx Demo 1

如果您希望简化/修改/探索该表达式，请在 regex101.com的右上角进行说明。如果愿意，您还可以在 this link中观看它如何与某些示例输入匹配。

RegEx电路
jex.im可视化正则表达式: