(?m)

来源：互联网发布：润锦众成网络贷款编辑：程序博客网时间：2024/04/28 22:00
centos6.5:/root/sbin#cat -n vv     1192.168.11.186,192.168.11.18735199,3306Dec  7, 2016 11:40:02.750520978SELECT      2    r.trx_id waiting_trx_id,\x0a    r.trx_mysql_thread_id waiting_thread,\x0a   r.trx_query waiting_query,\x0a    b.trx_id blocking_trx_id,\x0a    b.trx_mysql_thread_id blocking_thread,\x0a    b.trx_query blocking_query\x0aFROM\x0a    information_schema.innodb_lock_waits w\x0a        INNER JOIN\x0a    information_schema.innodb_trx b ON b.trx_id = w.blocking_trx_id\x0a        INNER JOIN\x0a    information_schema.innodb_trx r ON r.trx_id = w.requesting_trx_id此时分为2行%{IPORHOST:clientip},%{IPORHOST:serverip}\s+(?<client_port>\S+),(?<server_port>\S+)\s+(?<time>(\S+\s+).*?[0-9]{2}:[0-9]{2}:[0-9]{2}\.\d+)\s+(?<running_sql>(\S+\s+).*){  "clientip": [    [      "192.168.11.186"    ]  ],  "serverip": [    [      "192.168.11.187"    ]  ],  "client_port": [    [      "35199"    ]  ],  "server_port": [    [      "3306"    ]  ],  "time": [    [      "Dec  7, 2016 11:40:02.750520978"    ]  ],  "running_sql": [    [      "SELECT \n    r.trx_id waiting_trx_id,\\x0a    r.trx_mysql_thread_id waiting_thread,\\x0a   r.trx_query waiting_query,\\x0a    b.trx_id blocking_trx_id,\\x0a    b.trx_mysql_thread_id blocking_thread,\\x0a    b.trx_query blocking_query\\x0aFROM\\x0a    information_schema.innodb_lock_waits w\\x0a        INNER JOIN\\x0a    information_schema.innodb_trx b ON b.trx_id = w.blocking_trx_id\\x0a        INNER JOIN\\x0a    information_schema.innodb_trx r ON r.trx_id = w.requesting_trx_id"    ]  ]}此时可以玩转匹配/*************centos6.5:/root/sbin#cat -n dd     1192.168.11.186,192.168.11.18735199,3306Dec  7, 2016 11:40:02.750520978SELECT      2    r.trx_id waiting_trx_id,\x0a    r.trx_mysql_thread_id waiting_thread,\x0a   r.trx_query waiting_query,\x0a    b.trx_id blocking_trx_id,\x0a    b.trx_mysql_thread_id blocking_thread,\x0a    b.trx_query blocking_query\x0aFROM\x0a        3 information_schema.innodb_lock_waits w\x0a        INNER JOIN\x0a    information_schema.innodb_trx b ON b.trx_id = w.blocking_trx_id\x0a        INNER JOIN\x0a    information_schema.innodb_trx r ON r.trx_id = w.requesting_trx_id换成3行此时{  "clientip": [    [      "192.168.11.186"    ]  ],  "serverip": [    [      "192.168.11.187"    ]  ],  "client_port": [    [      "35199"    ]  ],  "server_port": [    [      "3306"    ]  ],  "time": [    [      "Dec  7, 2016 11:40:02.750520978"    ]  ],  "running_sql": [    [      "SELECT \n    r.trx_id waiting_trx_id,\\x0a    r.trx_mysql_thread_id waiting_thread,\\x0a   r.trx_query waiting_query,\\x0a    b.trx_id blocking_trx_id,\\x0a    b.trx_mysql_thread_id blocking_thread,\\x0a    b.trx_query blocking_query\\x0aFROM\\x0a   "    ]  ]}匹配不完整了需要(?m)%{IPORHOST:clientip},%{IPORHOST:serverip}\s+(?<client_port>\S+),(?<server_port>\S+)\s+(?<time>(\S+\s+).*?[0-9]{2}:[0-9]{2}:[0-9]{2}\.\d+)\s+(?<running_sql>(\S+\s+).*)在和 codec/multiline 搭配使用的时候，需要注意一个问题，grok 正则和普通正则一样，默认是不支持匹配回车换行的。就像你需要 =~ //m 一样也需要单独指定，具体写法是在表达式开始位置加 (?m) 标记。如下所示：
0 0