<div id="readability-page-1" class="page"><div id="post-body-4251513065431928459" itemprop="articleBody">
;을 구분자로 사용한 데이터 분리.
<div><pre><code>- script:&nbsp; &nbsp; lang: javascript&nbsp; &nbsp; source: &gt;&nbsp; &nbsp; &nbsp; function process(evt)&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; var str = evt.Get('message').split(';')&nbsp; &nbsp; &nbsp; &nbsp; evt.Put('result', str)&nbsp; &nbsp; &nbsp; }</code></pre></div>
<div><pre><code>{&nbsp; "@timestamp": "2025-02-27T03:49:19.802Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "8.17.0"&nbsp; },&nbsp; "message": "type:&nbsp; 5 crl.root-x1.letsencrypt.org.edgekey.net;type:&nbsp; 5 e8652.dscx.akamaiedge.net;::ffff:23.207.177.83;",<a name="more"></a>&nbsp; "result": [&nbsp; &nbsp; "type:&nbsp; 5 crl.root-x1.letsencrypt.org.edgekey.net",&nbsp; &nbsp; "type:&nbsp; 5 e8652.dscx.akamaiedge.net",&nbsp; &nbsp; "::ffff:23.207.177.83",&nbsp; &nbsp; ""&nbsp; ]}</code></pre></div>
마지막 구분자 때문에 빈 값이 추출된다. 정규표현식으로 구분자만 제외.
<div><pre><code>- script:&nbsp; &nbsp; lang: javascript&nbsp; &nbsp; source: &gt;&nbsp; &nbsp; &nbsp; function process(evt) {&nbsp; &nbsp; &nbsp; &nbsp; var str = evt.Get('message').match(/[^;]+/);&nbsp; &nbsp; &nbsp; &nbsp; evt.Put('result', str)&nbsp; &nbsp; &nbsp; }</code></pre></div>
<div><pre><code>{&nbsp; "@timestamp": "2025-02-27T03:53:10.537Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "8.17.0"&nbsp; },&nbsp; "message": "type:&nbsp; 5 crl.root-x1.letsencrypt.org.edgekey.net;type:&nbsp; 5 e8652.dscx.akamaiedge.net;::ffff:23.207.177.83;",&nbsp; "result": [&nbsp; &nbsp; "type:&nbsp; 5 crl.root-x1.letsencrypt.org.edgekey.net"&nbsp; ]}</code></pre></div>
첫 번째 데이터만 추출된다. 정규표현식은 최초 검사 성공 후 중지되기 때문. 모든 데이터를 검사하도록 글로벌(g) 수정자 추가.
<div><pre><code>- script:&nbsp; &nbsp; &nbsp; lang: javascript&nbsp; &nbsp; &nbsp; source: &gt;&nbsp; &nbsp; &nbsp; &nbsp; function process(evt) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var str = evt.Get('message').match(/[^;]+/g);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; evt.Put('result', str)&nbsp; &nbsp; &nbsp; &nbsp; }</code></pre></div>
<div><pre><code>{&nbsp; "@timestamp": "2025-02-27T03:54:35.866Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "8.17.0"&nbsp; },&nbsp; "message": "type:&nbsp; 5 crl.root-x1.letsencrypt.org.edgekey.net;type:&nbsp; 5 e8652.dscx.akamaiedge.net;::ffff:23.207.177.83;",&nbsp; "result": [&nbsp; &nbsp; "type:&nbsp; 5 crl.root-x1.letsencrypt.org.edgekey.net",&nbsp; &nbsp; "type:&nbsp; 5 e8652.dscx.akamaiedge.net",&nbsp; &nbsp; "::ffff:23.207.177.83"&nbsp; ]}</code></pre></div>
원하는 구조가 나왔으니 정규표현식만 좀 더 깔끔하게 수정.
<div><pre><code>- script:&nbsp; &nbsp; lang: javascript&nbsp; &nbsp; source: &gt;&nbsp; &nbsp; &nbsp; function process(evt) {&nbsp; &nbsp; &nbsp; &nbsp; var str = evt.Get('message').match(/[^ :;]+\.[^;]+/g);&nbsp; &nbsp; &nbsp; &nbsp; evt.Put('result', str)&nbsp; &nbsp; &nbsp; }</code></pre></div>
<div><pre><code>{&nbsp; "@timestamp": "2025-02-27T03:56:28.797Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "8.17.0"&nbsp; },&nbsp; "message": "type:&nbsp; 5 crl.root-x1.letsencrypt.org.edgekey.net;type:&nbsp; 5 e8652.dscx.akamaiedge.net;::ffff:23.207.177.83;",&nbsp; "result": [&nbsp; &nbsp; "crl.root-x1.letsencrypt.org.edgekey.net",&nbsp; &nbsp; "e8652.dscx.akamaiedge.net",&nbsp; &nbsp; "23.207.177.83"&nbsp; ]}</code></pre></div>
<div>관련 글<div><ul><li><a href="https://kangmyounghun.blogspot.com/2025/01/filebeat-processors-5th.html">Beat processors - 5th</a></li><li><a href="https://kangmyounghun.blogspot.com/2023/09/convert-ip-to-decimal.html">convert ip to decimal</a></li><li><a href="https://kangmyounghun.blogspot.com/2021/10/key-value.html" target="">엘라스틱의 key-value 처리</a></li><li><a href="https://kangmyounghun.blogspot.com/2021/06/processors-registereddomain.html" target="">도메인 정규화 Processor: registered_domain</a></li></ul></div></div>

</div></div>

케세라세라

;을 구분자로 사용한 데이터 분리.
- script:
    lang: javascript
    source: >
      function process(evt) 
        var str = evt.Get('message').split(';')
        evt.Put('result', str)
      }
{
  "@timestamp": "2025-02-27T03:49:19.802Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "8.17.0"
  },
  "message": "type:  5 crl.root-x1.letsencrypt.org.edgekey.net;type:  5 e8652.dscx.akamaiedge.net;::ffff:23.207.177.83;",
  "result": [
    "type:  5 crl.root-x1.letsencrypt.org.edgekey.net",
    "type:  5 e8652.dscx.akamaiedge.net",
    "::ffff:23.207.177.83",
    ""
  ]
}
마지막 구분자 때문에 빈 값이 추출된다. 정규표현식으로 구분자만 제외.
- script:
    lang: javascript
    source: >
      function process(evt) {
        var str = evt.Get('message').match(/[^;]+/);
        evt.Put('result', str)
      }
{
  "@timestamp": "2025-02-27T03:53:10.537Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "8.17.0"
  },
  "message": "type:  5 crl.root-x1.letsencrypt.org.edgekey.net;type:  5 e8652.dscx.akamaiedge.net;::ffff:23.207.177.83;",
  "result": [
    "type:  5 crl.root-x1.letsencrypt.org.edgekey.net"
  ]
}
첫 번째 데이터만 추출된다. 정규표현식은 최초 검사 성공 후 중지되기 때문. 모든 데이터를 검사하도록 글로벌(g) 수정자 추가.
- script:
      lang: javascript
      source: >
        function process(evt) {
          var str = evt.Get('message').match(/[^;]+/g);
          evt.Put('result', str)
        }
{
  "@timestamp": "2025-02-27T03:54:35.866Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "8.17.0"
  },
  "message": "type:  5 crl.root-x1.letsencrypt.org.edgekey.net;type:  5 e8652.dscx.akamaiedge.net;::ffff:23.207.177.83;",
  "result": [
    "type:  5 crl.root-x1.letsencrypt.org.edgekey.net",
    "type:  5 e8652.dscx.akamaiedge.net",
    "::ffff:23.207.177.83"
  ]
}
원하는 구조가 나왔으니 정규표현식만 좀 더 깔끔하게 수정.
- script:
    lang: javascript
    source: >
      function process(evt) {
        var str = evt.Get('message').match(/[^ :;]+\.[^;]+/g);
        evt.Put('result', str)
      }
{
  "@timestamp": "2025-02-27T03:56:28.797Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "8.17.0"
  },
  "message": "type:  5 crl.root-x1.letsencrypt.org.edgekey.net;type:  5 e8652.dscx.akamaiedge.net;::ffff:23.207.177.83;",
  "result": [
    "crl.root-x1.letsencrypt.org.edgekey.net",
    "e8652.dscx.akamaiedge.net",
    "23.207.177.83"
  ]
}
관련 글
Beat processors - 5th
convert ip to decimal
엘라스틱의 key-value 처리
도메인 정규화 Processor: registered_domain

Beat processors - 6th

댓글