Support Questions
Find answers, ask questions, and share your expertise

so confused for Kite Grok, please give me some help.

Highlighted

so confused for Kite Grok, please give me some help.

Expert Contributor

the log MySQL slow log, the stytle is:  "2015-10-18 08:51:47","dop[dop] @  [10.32.52.2]","00:00:01","00:00:00",4898,4898,"dop",0,0,1,"SELECT * FROM `t_dealer`"

 

morphlines conf is below:

 

"%{DATA:start_time}","%{DATA:user_host}","%{DATA:query_time}","%{DATA:lock_time}",%{DATA:rows_sent},%{DATA:rows_examined},"%{DATA:db}",%{DATA:last_insert_id},%{DATA:insert_id},%{DATA:server_id},"%{DATA:sql_text}"

 

i have tested on https://grokdebug.herokuapp.com/ , it works well. the result is:

 

{
  "start_time": [
    [
      "2015-10-18 08:51:47"
    ]
  ],
  "user_host": [
    [
      "dop[dop] @  [10.32.52.2]"
    ]
  ],
  "query_time": [
    [
      "00:00:01"
    ]
  ],
  "lock_time": [
    [
      "00:00:00"
    ]
  ],
  "rows_sent": [
    [
      "4898"
    ]
  ],
  "rows_examined": [
    [
      "4898"
    ]
  ],
  "db": [
    [
      "dop"
    ]
  ],
  "last_insert_id": [
    [
      "0"
    ]
  ],
  "insert_id": [
    [
      "0"
    ]
  ],
  "server_id": [
    [
      "1"
    ]
  ],
  "sql_text": [
    [
      "SELECT * FROM `t_dealer`"
    ]
  ]
}

 

but it's failed when integrated with flume, and the error is like below:

 

com.typesafe.config.ConfigException$Parse: /data/opbin/flume-ng/conf/morphlineFile.conf: 49: Key '"%{DATA:user_host}"' may not be followed by token: ',' (if you intended ',' to be part of the value for '"%{DATA:user_host}"', try enclosing the value in double quotes)

 

who can give me some advises for this problem?  

 

thanks very much.

 

2 REPLIES 2
Highlighted

Re: so confused for Kite Grok, please give me some help.

Expert Contributor
got resolved,

the error means if , is value, should quoted. then i change my expression to :

"%{DATA:start_time},%{DATA:user_host},%{DATA:query_time},%{DATA:lock_time},%{DATA:rows_sent},%{DATA:rows_examined},%{DATA:db},%{DATA:last_insert_id},%{DATA:insert_id},%{DATA:server_id},%{DATA:sql_text}"

Re: so confused for Kite Grok, please give me some help.

Community Manager

Congratulations! Feel free to mark your last comment as the solution in case someone else has a similar issue in the future. :)


Cy Jervis, Community Manager

Was your question answered? Make sure to mark the answer as the accepted solution.
If you find a reply useful, say thanks by clicking on the thumbs up button.

Learn more about the Cloudera Community:
Community Guidelines
How to use the forum