Filebeat Dissect处理器空分隔符异常排查与解决

问题详情 #

使用指定Dissect模式解析日志时，该模式在dissect-tester工具中验证正常，但Filebeat抛出找不到空分隔符的错误。

Dissect模式 #

%{level} : %{timestamp} [%{class}] (%{file}) - %{message}

待解析日志消息 #

INFO : 2023-06-30 10:30:53,208 [d.f.f.w.c.c.GeoServerHelper] (GeoServerHelper.java:208) - Response erhalten vom GeoServer in 2269ms

Filebeat错误日志 #

2023-06-30T10:31:32.515Z        DEBUG   [processors]    processing/processors.go:128    Fail to apply processor client{dissect=%{level} : %{timestamp} [%{class}] (%{file}) - %{message},field=message,target_prefix=, timestamp=[field=timestamp, target_field=@timestamp, timezone=UTC, layouts=[2006-01-02 15:04:05,999]], add_tags=tag}: could not find delimiter: `` in remaining: `INFO : 2023-06-30 10:30:53,208 [d.f.f.w.c.c.GeoServerHelper] (GeoServerHelper.java:208) - Response erhalten vom GeoServer in 2269ms`, (offset: 0)

对应Filebeat配置 #

- type: filestream
  id: converter-logstream-id
  paths:
    - /logs/converter/*.log
  prospector.scanner.exclude_files:
    ["^/logs/content2alert-converter/transfer.log"]
  fields:
    input_source: converter
  processors:
    - dissect:
        tokenizer: "%{level} : %{timestamp} [%{class}] (%{file}) - %{message}"
        # field: "message"
        target_prefix: ""
        # trim_values: left
        overwrite_keys: true
    - timestamp:
        field: timestamp
        layouts:
          - "2006-01-02 15:04:05,999"
        test:
          - "2023-06-28 09:30:14,208"
    - add_tags:
        tags: [converter]
        target: "group"

排查与解决 #

最初怀疑Dissect模式存在问题，将日志输出到控制台后发现，日志中包含Unicode颜色控制字符，而所用日志框架为logback且无法修改其配置。最终通过添加自定义JavaScript脚本处理器移除这些控制字符，解决了解析报错问题。

解决脚本（需添加到Filebeat的processors列表最前端） #

- script:
    lang: javascript
    source: >
      function process(event) {
        var originalMsg = event.Get('message')
        var msg = originalMsg.replace(/\x1b\[([0-9,A-Z]{1,2}(;[0-9]{1,2})?(;[0-9]{3})?)?[m|K]?/g, '');
        event.Put("message", msg);
      }

内容的提问来源于stack exchange，提问作者Calipee