如果模式中存在动态空间，Filebeat 多行模式将不起作用

Question

下面是我从 JVM GC 输出传入的日志

[2024-10-16T00:53:05.165+0000][6.308s][gc,heap] GC(0)  Metaspace       used 12167K, committed 12480K, reserved 1114112K
[2024-10-16T00:53:05.165+0000][6.308s][gc,heap] GC(0)   class space    used 1260K, committed 1408K, reserved 1048576K
[2024-10-16T00:53:05.165+0000][6.308s][gc     ] GC(0) Pause Young (Normal) (G1 Evacuation Pause) 51M->10M(1032M) 12.441ms
[2024-10-16T00:53:05.165+0000][6.308s][gc,heap] GC(1)  Metaspace       used 12167K, committed 12480K, reserved 1114112K
[2024-10-16T00:53:05.165+0000][6.308s][gc,heap] GC(1)   class space    used 1260K, committed 1408K, reserved 1048576K
[2024-10-16T00:53:05.165+0000][6.308s][gc     ] GC(1) Pause Young (Normal) (G1 Evacuation Pause) 51M->10M(1032M) 12.441ms
[2024-10-16T00:53:05.165+0000][6.308s][gc,heap] GC(2)  Metaspace       used 12167K, committed 12480K, reserved 1114112K
[2024-10-16T00:53:05.165+0000][6.308s][gc,heap] GC(2)   class space    used 1260K, committed 1408K, reserved 1048576K
[2024-10-16T00:53:05.165+0000][6.308s][gc     ] GC(2) Pause Full (System.gc()) 3531M->2934M(7696M) 3796.534ms

从上面我需要用多行模式分割，因为所有 GC(0) 到 1 条消息，GC(1) 到另一个消息等。下面是我尝试过的模式，我无法尝试用“[gc ]”分割每个 GC 输出末尾的一行之间的字段：

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - "/opt/micro_service/TA/MOUNT/gc_logs/s1gc3.log"
  multiline.pattern: '^\[gc[[:space:]]\](.)*?'
  multiline.negate: true
  multiline.match: before

请让我知道问题

Answer 1

请尝试这个，不要使用“log”输入，而是使用“filestream”输入。

filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - "/opt/micro_service/TA/MOUNT/gc_logs/s1gc3.log"
  parsers:
  - multiline:
      type: pattern
      pattern: '^\[gc[[:space:]]\](.)*?'
      negate: true
      match: after

注意：在模式中你也可以像下面这样提及

pattern: ' Metaspace       used '