Closed Gunara-Godofdarkness closed 1 year ago
filters: - Grok: src: message match: - '^\[(?P<time_local>.*)\] \[(?P<host>.*)\] \[(?P<scheme>.*)\] \[(?P<request_method>.*)\] \[(?P<request_uri>.*)\] \[(?P<request_body>.*)\] \[(?P<status>.*)\] \[(?P<body_bytes_sent>.*)\] \[(?P<request_length>.*)\] \[(?P<http_referer>.*)\] \[(?P<http_user_agent>.*)\] \[(?P<http_x_forwarded_for>.*)\] \[(?P<http_cookie>.*)\] \[(?P<upstream_response_time>.*)\] \[(?P<request_time>.*)\] \[(?P<upstream_addr>.*)\] \[(?P<server_addr>.*)\]$' remove_fields: ['message'] - Date: location: 'Asia/Shanghai' src: time_local target: timestamp formats: - 'RFC3339' remove_fields: ["time_local"] - Drop: if: - '!EQ($.host,"wlya.xxx.cn") || !EQ($.host,"pc3.xxx.cn")' #这行配置没生效,有什么问题吗,如果写一个条件是可以的,||好像不行
- Drop: if: - '!(EQ($.host,"wlya.xxx.cn") || EQ($.host,"pc3.xxx.cn"))' 可以这样写
不好意思,回复晚了。
这个语法本身没问题,但是你这个逻辑有问题吧。 host 这个字段不可能即等于 A 又等于 B,所以这个条件永远不能满足。