Browse Source

HUE-4133 [search] Queries don't handle field names that contain spaces

Aaron Peddle 9 năm trước cách đây
mục cha
commit
d94c1f7

+ 33 - 5
desktop/libs/indexer/src/data/oozie_workspace/parse_hue.conf

@@ -25,12 +25,40 @@
 { logTrace { format : "Output from multiline {}", args : ["@{}"] } }
 
 {
-  grok {
-    dictionaryFiles : ["grok_dictionaries"]
+  tryRules {
+    catchExceptions : true
+    throwExceptionIfAllRulesFailed : true
+    rules : [
+      # next rule of tryRules cmd:
+      {
+        commands : [
+          {
+            grok {
+              dictionaryFiles : ["grok_dictionaries"]
 
-    expressions : {
-      message: """\[%{GREEDYDATA:date}\] %{WORD:component} +%{LOGLEVEL:log_level} %{GREEDYDATA:details}[\s\S]*"""
-    }
+              expressions : {
+                message: """\[%{GREEDYDATA:date}\] %{WORD:component} +%{LOGLEVEL:log_level} +%{IP:ip} %{WORD:user} - "%{WORD:http_method} %{NOTSPACE:path} %{NOTSPACE:protocol}"%{GREEDYDATA:details}"""
+              }
+            }
+          }
+        ]
+      }
+
+      # next rule of tryRules cmd:
+      {
+        commands : [
+          {
+            grok {
+              dictionaryFiles : ["grok_dictionaries"]
+
+              expressions : {
+                message: """\[%{GREEDYDATA:date}\] %{WORD:component} +%{LOGLEVEL:log_level} %{GREEDYDATA:details}[\s\S]*"""
+              }
+            }
+          }
+        ]
+      }
+    ]
   }
 }
 { logTrace { format : "Output from multiline grok {}", args : ["@{}"] } }

+ 6 - 1
desktop/libs/indexer/src/indexer/file_format.py

@@ -135,7 +135,12 @@ class HueFormat(FileFormat):
       Field("component", "string"),
       Field("log_level", "string"),
       Field("details", "string"),
-      Field("message", "text")
+      Field("message", "text_en"),
+      Field("ip", "string"),
+      Field("user", "string"),
+      Field("http_method", "string"),
+      Field("path", "string"),
+      Field("protocol", "string")
     ]
 
   @property