Rsyslog - Tomcat 异常

Question

我试图将 tomcat 异常行放入 1 条消息中，但是将正则表达式部分添加到配置中时没有任何效果。 没有正则表达式部分，我可以逐行获取所有日志！

module(load="imfile" PollingInterval="10") #needs to be done just once
#File 1
input(type="imfile"
File="/tomcat/logs/catalina.out"
Tag="catalina"
Severity="info"
Facility="local1")

# Filter for JasperException stack traces and forward to remote server
if $msg regex "(?s)org\.apache\.jasper\.JasperException:.*?Caused by: java\.lang\.NullPointerException.*?\s{4}at.*?[\r\n]*" then {
    action(type="omfwd" target="192.168.0.1" port="514" protocol="tcp" facility="local1" severity="err")
}

local1.* @192.168.0.1:514

Answer 1

鉴于此堆栈跟踪

org.apache.jasper.JasperException: java.lang.NullPointerException
    org.apache.jasper.servlet.JspServletWrapper.handleJspException(JspServletWrapper.java:502)
    org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:430)
    org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:313)
    org.apache.jasper.servlet.JspServlet.service(JspServlet.java:260)
    javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
    org.apache.jasper.runtime.PageContextImpl.doForward(PageContextImpl.java:709)
    org.apache.jasper.runtime.PageContextImpl.forward(PageContextImpl.java:680)
    org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:821)
    org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:794)
    org.apache.jsp.LPSSuppIndex_jsp._jspService(LPSSuppIndex_jsp.java:393)
    org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
    javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
    org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:388)
    org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:313)
    org.apache.jasper.servlet.JspServlet.service(JspServlet.java:260)
    javax.servlet.http.HttpServlet.service(HttpServlet.java:717)

这个正则表达式将匹配所有行

(?sm)org\.apache\.jasper\.JasperException:.* java\.lang\.NullPointerException[\r\n]{1,2}(\s+[^\s]+[\r\n]{1,2}){1,}