centos6.5:/root/sbin#cat -n vv 1 192.168.11.186,192.168.11.187 35199,3306 Dec 7, 2016 11:40:02.750520978 SELECT 2 r.trx_id waiting_trx_id,x0a r.trx_mysql_thread_id waiting_thread,x0a r.trx_query waiting_query,x0a b.trx_id blocking_trx_id,x0a b.trx_mysql_thread_id blocking_thread,x0a b.trx_query blocking_queryx0aFROMx0a information_schema.innodb_lock_waits wx0a INNER JOINx0a information_schema.innodb_trx b ON b.trx_id = w.blocking_trx_idx0a INNER JOINx0a information_schema.innodb_trx r ON r.trx_id = w.requesting_trx_id 此时分为2行 %{IPORHOST:clientip},%{IPORHOST:serverip}s+(?<client_port>S+),(?<server_port>S+)s+(?<time>(S+s+).*?[0-9]{2}:[0-9]{2}:[0-9]{2}.d+)s+(?<running_sql>(S+s+).*) { "clientip": [ [ "192.168.11.186" ] ], "serverip": [ [ "192.168.11.187" ] ], "client_port": [ [ "35199" ] ], "server_port": [ [ "3306" ] ], "time": [ [ "Dec 7, 2016 11:40:02.750520978" ] ], "running_sql": [ [ "SELECT r.trx_id waiting_trx_id,\x0a r.trx_mysql_thread_id waiting_thread,\x0a r.trx_query waiting_query,\x0a b.trx_id blocking_trx_id,\x0a b.trx_mysql_thread_id blocking_thread,\x0a b.trx_query blocking_query\x0aFROM\x0a information_schema.innodb_lock_waits w\x0a INNER JOIN\x0a information_schema.innodb_trx b ON b.trx_id = w.blocking_trx_id\x0a INNER JOIN\x0a information_schema.innodb_trx r ON r.trx_id = w.requesting_trx_id" ] ] } 此时可以玩转匹配 /************* centos6.5:/root/sbin#cat -n dd 1 192.168.11.186,192.168.11.187 35199,3306 Dec 7, 2016 11:40:02.750520978 SELECT 2 r.trx_id waiting_trx_id,x0a r.trx_mysql_thread_id waiting_thread,x0a r.trx_query waiting_query,x0a b.trx_id blocking_trx_id,x0a b.trx_mysql_thread_id blocking_thread,x0a b.trx_query blocking_queryx0aFROMx0a 3 information_schema.innodb_lock_waits wx0a INNER JOINx0a information_schema.innodb_trx b ON b.trx_id = w.blocking_trx_idx0a INNER JOINx0a information_schema.innodb_trx r ON r.trx_id = w.requesting_trx_id 换成3行 此时 { "clientip": [ [ "192.168.11.186" ] ], "serverip": [ [ "192.168.11.187" ] ], "client_port": [ [ "35199" ] ], "server_port": [ [ "3306" ] ], "time": [ [ "Dec 7, 2016 11:40:02.750520978" ] ], "running_sql": [ [ "SELECT r.trx_id waiting_trx_id,\x0a r.trx_mysql_thread_id waiting_thread,\x0a r.trx_query waiting_query,\x0a b.trx_id blocking_trx_id,\x0a b.trx_mysql_thread_id blocking_thread,\x0a b.trx_query blocking_query\x0aFROM\x0a " ] ] } 匹配不完整了 需要 (?m)%{IPORHOST:clientip},%{IPORHOST:serverip}s+(?<client_port>S+),(?<server_port>S+)s+(?<time>(S+s+).*?[0-9]{2}:[0-9]{2}:[0-9]{2}.d+)s+(?<running_sql>(S+s+).*) 在和 codec/multiline 搭配使用的时候,需要注意一个问题, grok 正则和普通正则一样,默认是不支持匹配回车换行的。 就像你需要 =~ //m 一样也需要单独指定,具体写法是在表达式开始位置加 (?m) 标记。如下所示: