logstash  中的贪婪匹配:

10.252.142.174 - - [06/Sep/2016:08:41:36 +0800] "GET /api/validate/code/send?mobilePhone=18652221499&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.010 112.17.240.27

表达式:

%{IPORHOST:clientip}\s+\-\s+\-\s+\[%{HTTPDATE:time}\]\s+\"%{WORD:verb}\s+(?<api>(\S+))\?.*%{IPORHOST:remote}

输出；

{

  "clientip": [

    [

      "10.252.142.174"

    ]

  ],

  "time": [

    [

      "06/Sep/2016:08:41:36 +0800"

    ]

  ],

  "verb": [

    [

      "GET"

    ]

  ],

  "api": [

    [

      "/api/validate/code/send"

    ]

  ],

  "remote": [

    [

      "27"

    ]

  ]

}

此时remote 输出27

/*****************

%{IPORHOST:clientip}\s+\-\s+\-\s+\[%{HTTPDATE:time}\]\s+\"%{WORD:verb}\s+(?<api>(\S+))\?.*?%{IPORHOST:remote}

此时输出:

{

  "clientip": [

    [

      "10.252.142.174"

    ]

  ],

  "time": [

    [

      "06/Sep/2016:08:41:36 +0800"

    ]

  ],

  "verb": [

    [

      "GET"

    ]

  ],

  "api": [

    [

      "/api/validate/code/send"

    ]

  ],

  "remote": [

    [

      "112.17.240.27"

    ]

  ]

}

或者:

%{IPORHOST:clientip}\s+\-\s+\-\s+\[%{HTTPDATE:time}\]\s+\"%{WORD:verb}\s+(?<api>(\S+))\?.*\s+%{IPORHOST:remote}