ELK解決日誌換行問題

我們在部署elk完後，在kibana上發現很多ERROR日誌換行情況，結果會在kibana上看到多行的error日誌

我們常出現的ERROR日誌如下

[INFO][2020-03-22 22:37:05,064][org.apache.commons.httpclient.HttpMethodDirector]Retrying request
java.net.ConnectException: 拒絕連接 (Connection refused)
	at java.net.PlainSocketImpl.socketConnect(Native Method)
	at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
	at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
	at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
	at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
	at java.net.Socket.connect(Socket.java:589)
	at sun.reflect.GeneratedMethodAccessor178.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.apache.commons.httpclient.protocol.ReflectionSocketFactory.createSocket(ReflectionSocketFactory.java:140)
	at org.apache.commons.httpclient.protocol.DefaultProtocolSocketFactory.createSocket(DefaultProtocolSocketFactory.java:125)
	at org.apache.commons.httpclient.HttpConnection.open(HttpConnection.java:707)
	at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:387)
	at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
	at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
	at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:323)
	at hry.utils.HttpClientWithJson.sendPostWithJson(HttpClientWithJson.java:39)
	at hry.api.moac.service.MoacService.getBlockNumber(MoacService.java:193)
	at hry.api.moac.MoacUtil.moacProductionTx(MoacUtil.java:313)
	at hry.quart.CoinQuart.moacProductionTx(CoinQuart.java:434)
	at sun.reflect.GeneratedMethodAccessor211.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at hry.core.quartz.TaskUtils.invokMethod(tb:4)
	at hry.core.quartz.QuartzJob.execute(jc:191)
	at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
	at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:525)
java.lang.RuntimeException: 接口連接失敗！
	at hry.utils.HttpClientWithJson.sendPostWithJson(HttpClientWithJson.java:55)
	at hry.api.moac.service.MoacService.getBlockNumber(MoacService.java:193)
	at hry.api.moac.MoacUtil.moacProductionTx(MoacUtil.java:313)
	at hry.quart.CoinQuart.moacProductionTx(CoinQuart.java:434)
	at sun.reflect.GeneratedMethodAccessor211.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at hry.core.quartz.TaskUtils.invokMethod(tb:4)
	at hry.core.quartz.QuartzJob.execute(jc:191)
	at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
	at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:525)
java.lang.reflect.InvocationTargetException
	at sun.reflect.GeneratedMethodAccessor211.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at hry.core.quartz.TaskUtils.invokMethod(tb:4)
	at hry.core.quartz.QuartzJob.execute(jc:191)
	at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
	at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:525)
Caused by: java.lang.NullPointerException

爲了讓我們的error日誌不換行，我們就需要引入multiline這個中間鍵

因爲logstash本身不帶，所以需要我們安裝，在我們的logstash的bin目錄下執行 ./logstash-plugin install  logstash-filter-multiline
如下圖，出現successful則表示安裝成功

[root@manage-host bin]# ./logstash-plugin install  logstash-filter-multiline
Validating logstash-filter-multiline
Installing logstash-filter-multiline
Installation successful

其次我們就需要重新配置logstash的配置文件

配置文件的filter部分如下

filter {
       multiline {
           pattern => "^\["       # 正則匹配以[開頭的
           negate => true         # true:表示不匹配正則表達式時，false:匹配正則表達式時（negate相反的）
           what => "previous"     # 設置未匹配的內容是向前合併還是先後合併,previous向前合併，next向後合併
       }
}

至此就能看到我們的ERROR日誌不換行的結果了