You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

求提取Tomcat日志时间戳的正则表达式（FluentBit对接New Relic）

avatar
云原生阿岚
2026-8-23
Tomcat catalina.out日志FluentBit解析异常问题

问题背景

使用FluentBit解析应用日志时运行正常，但处理Tomcat的catalina.out日志时出现异常，当前使用的正则表达式为：/(?<time>Dec \d+ \d+:\d+:\d+)(?<message>.*)/

示例Tomcat日志条目 

05-Aug-2022 09:01:04.533 SEVERE [http-nio-8080-exec-17] com.sun.faces.application.view.FaceletViewHandlingStrategy.handleRenderException Error Rendering View[/pages/inicio.xhtml]
    java.lang.IllegalStateException: WELD-000343: Unable to load the current conversation from the associated request - org.jboss.weld.context.ConversationContext.currentConversation: null, request: org.apache.catalina.connector.RequestFacade@1b943ff4
            at org.jboss.weld.contexts.AbstractConversationContext.getCurrentConversation(AbstractConversationContext.java:512)
            at org.jboss.weld.module.jsf.ConversationAwareViewHandler.getActionURL(ConversationAwareViewHandler.java:114)
            at javax.faces.application.ViewHandlerWrapper.getActionURL(ViewHandlerWrapper.java:234)
            at com.sun.faces.renderkit.html_basic.FormRenderer.getActionStr(FormRenderer.java:237)
            at com.sun.faces.renderkit.html_basic.FormRenderer.encodeBegin(FormRenderer.java:136)
            at javax.faces.component.UIComponentBase.encodeBegin(UIComponentBase.java:892)
            at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1903)
            at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1908)
            at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1908)
            at com.sun.faces.application.view.FaceletViewHandlingStrategy.renderView(FaceletViewHandlingStrategy.java:491)
            at com.sun.faces.application.view.MultiViewHandler.renderView(MultiViewHandler.java:194)
            at javax.faces.application.ViewHandlerWrapper.renderView(ViewHandlerWrapper.java:151)
            at javax.faces.application.ViewHandlerWrapper.renderView(ViewHandlerWrapper.java:151)
            at org.omnifaces.viewhandler.OmniViewHandler.renderView(OmniViewHandler.java:155)
            at com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:126)
            at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100)
            at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:223)
            at javax.faces.webapp.FacesServlet.service(FacesServlet.java:671)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at ar.com.dux.jsf.filters.CacheFilter.doFilter(CacheFilter.java:27)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at ar.com.dux.jsf.filters.SecurityFilter.conresultado(SecurityFilter.java:98)
            at ar.com.dux.jsf.filters.SecurityFilter.doFilter(SecurityFilter.java:83)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.primefaces.webapp.filter.FileUploadFilter.doFilter(FileUploadFilter.java:89)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.omnifaces.filter.GzipResponseFilter.doFilter(GzipResponseFilter.java:183)
            at org.omnifaces.filter.HttpFilter.doFilter(HttpFilter.java:108)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:196)
            at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
            at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542)
            at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
            at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)
            at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:698)
            at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
            at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:364)
            at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:624)
            at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
            at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:831)
            at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1650)
            at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
            at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
            at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
            at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
            at java.lang.Thread.run(Thread.java:748)
05-Aug-2022 09:03:10.705 SEVERE [http-nio-8080-exec-16] com.sun.faces.application.view.FaceletViewHandlingStrategy.handleRenderException Error Rendering View[/pages/inicio.xhtml]
    java.lang.IllegalStateException: WELD-000343: Unable to load the current conversation from the associated request - org.jboss.weld.context.ConversationContext.currentConversation: null, request: org.apache.catalina.connector.RequestFacade@7f4b737c
            at org.jboss.weld.contexts.AbstractConversationContext.getCurrentConversation(AbstractConversationContext.java:512)
            at org.jboss.weld.module.jsf.ConversationAwareViewHandler.getActionURL(ConversationAwareViewHandler.java:114)
            at javax.faces.application.ViewHandlerWrapper.getActionURL(ViewHandlerWrapper.java:234)
            at com.sun.faces.renderkit.html_basic.FormRenderer.getActionStr(FormRenderer.java:237)
            at com.sun.faces.renderkit.html_basic.FormRenderer.encodeBegin(FormRenderer.java:136)
            at javax.faces.component.UIComponentBase.encodeBegin(UIComponentBase.java:892)
            at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1903)
            at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1908)
            at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1908)
            at com.sun.faces.application.view.FaceletViewHandlingStrategy.renderView(FaceletViewHandlingStrategy.java:491)
            at com.sun.faces.application.view.MultiViewHandler.renderView(MultiViewHandler.java:194)
            at javax.faces.application.ViewHandlerWrapper.renderView(ViewHandlerWrapper.java:151)
            at javax.faces.application.ViewHandlerWrapper.renderView(ViewHandlerWrapper.java:151)
            at org.omnifaces.viewhandler.OmniViewHandler.renderView(OmniViewHandler.java:155)
            at com.sun.faces.lifecycle.RenderResponsePhase.execute(RenderResponsePhase.java:126)
            at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100)
            at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:223)
            at javax.faces.webapp.FacesServlet.service(FacesServlet.java:671)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at ar.com.dux.jsf.filters.CacheFilter.doFilter(CacheFilter.java:27)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at ar.com.dux.jsf.filters.SecurityFilter.conresultado(SecurityFilter.java:98)
            at ar.com.dux.jsf.filters.SecurityFilter.doFilter(SecurityFilter.java:83)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.primefaces.webapp.filter.FileUploadFilter.doFilter(FileUploadFilter.java:89)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.omnifaces.filter.GzipResponseFilter.doFilter(GzipResponseFilter.java:183)
            at org.omnifaces.filter.HttpFilter.doFilter(HttpFilter.java:108)
            at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
            at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
            at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:196)
            at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
            at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542)
            at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
            at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)
            at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:698)
            at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
            at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:364)
            at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:624)
            at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
            at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:831)
            at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1650)
            at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
            at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
            at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
            at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
            at java.lang.Thread.run(Thread.java:748)

问题原因

  • 正则匹配不兼容：当前正则仅匹配Dec开头的时间格式，但Tomcat日志使用DD-MMM-YYYY HH:mm:ss.SSS格式，完全不匹配目标日志结构。
  • 未处理多行日志：Tomcat异常日志包含多行堆栈信息，默认FluentBit会将每一行视为独立日志，导致解析后日志碎片化、字段提取错误。

解决方案

1. 替换为匹配Tomcat格式的正则表达式

使用以下正则提取日志中的关键字段：

/(?<time>\d{2}-[A-Za-z]{3}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3}) (?<level>[A-Z]+) \[(?<thread>[^\]]+)\] (?<class>[^\s]+) (?<message>.*)/

该正则会提取：

  • time：完整日志时间（如05-Aug-2022 09:01:04.533）
  • level：日志级别（如SEVERE）
  • thread：线程名称（如http-nio-8080-exec-17）
  • class：触发日志的类/方法（如com.sun.faces.application.view.FaceletViewHandlingStrategy.handleRenderException）
  • message：日志核心内容（如Error Rendering View[/pages/inicio.xhtml]）

2. 配置FluentBit多行合并处理

在FluentBit输入配置中启用多行模式，将堆栈信息合并为单条日志：

[INPUT]
    Name              tail
    Path              /path/to/your/catalina.out
    Parser            tomcat_catalina
    Multiline         on
    Multiline_Firstline_Regexp /^\d{2}-[A-Za-z]{3}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3}/
    Tag               tomcat.catalina
  • Multiline_Firstline_Regexp：指定以时间格式开头的行是新日志的起始行，后续缩进的堆栈行将自动合并到上一条日志中。

3. 在parsers.conf中定义解析器

添加对应解析器配置，确保FluentBit正确识别时间戳和字段：

[PARSER]
    Name        tomcat_catalina
    Format      regex
    Regex       /(?<time>\d{2}-[A-Za-z]{3}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3}) (?<level>[A-Z]+) \[(?<thread>[^\]]+)\] (?<class>[^\s]+) (?<message>.*)/
    Time_Key    time
    Time_Format %d-%b-%Y %H:%M:%S.%L
    Time_Zone   Asia/Shanghai  # 根据服务器实际时区调整

4. 验证配置效果

重启FluentBit后，检查发送到New Relic的日志：

  • 每条异常日志包含完整的堆栈信息
  • 时间、级别、线程等字段均正确提取

内容的提问来源于stack exchange，提问作者dssof

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
火山引擎 最新活动
全面开放
Doubao-Seedance-2.5全新模型升级

模型再升级,30秒超长叙事, 模态参考扩容

HOT
方舟Codingplan

模型自由，工具不限，最新支持 Deepseek-V4 系列、GLM-5.3 系列

HOT
方舟Agent plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列

HOT
新用户特惠专场

大模型19元起，Al应用9.9元畅享，新人首购爆款尽享优惠

最近更新时间：2026.08.23 10:24:05