logstash处理MySQL慢日志，解决多行SQL匹配不完整问题

处理mysql慢日志
  input {  
      file {  
          type =>"mysql-slow"  
          path =>"/elk/mysql.log"  
          #start_position => "beginning"
          codec => multiline {  
              pattern =>"^# Time: "  
              negate => true  
              what =>"previous"  
              max_lines => 200000
              max_bytes => "100MiB"
          }  
      }  
  }  
   
  filter {  
      # drop sleep events  
      grok {  
          match => { "message" =>"SELECT SLEEP" }  
          add_tag => [ "sleep_drop" ]  
          tag_on_failure => [] # prevent default _grokparsefailure tag on real records  
      }  

      if "sleep_drop" in [tags] {  
          drop {}  
      }  

      grok {  #此正则为修改过的匹配方式，解决多行SQL匹配不完整问题：(?<sql>(?<action>w+)([w.*W.*])*;)
        match => { "message" => "(?m)^#s+Times?.*s+#s+User@Host:s+%{USER:user}[[^]]+]s+@s+(?:(?<clienthost>S*) )?[(?:%{IPV4:clientip})?]s+Id:s+%{NUMBER:row_id:int}
#s+Query_time:s+%{NUMBER:query_time:float}s+Lock_time:s+%{NUMBER:lock_time:float}s+Rows_sent:s+%{NUMBER:rows_sent:int}s+Rows_examined:s+%{NUMBER:rows_examined:int}
s*(?:use %{DATA:database};s*
)?SETs+timestamp=%{NUMBER:timestamp};
s*(?<sql>(?<action>w+)([w.*W.*])*;)s*$" }
      }  

      date {  
          match => [ "timestamp", "UNIX" ]  
          remove_field => [ "timestamp" ]  
      }  
  } 


  output {
         elasticsearch {
              hosts => ["10.x.x.1xx:9200"]
         }
           stdout {
                  codec => rubydebug
           }

  }

样例数据：
  # Time: 2019-04-25T05:53:29.251666Z
  # User@Host: fof[fof] @  [172.1x.1x.1xx]  Id:  3419
  # Query_time: 0.437667  Lock_time: 0.000122 Rows_sent: 1000  Rows_examined: 1000
  SET timestamp=1556171609;
  SELECT * FROM `tb_` LIMIT 0, 1000;


效果如下：
  {
          "lock_time" => 0.000122,
             "action" => "SELECT",
               "host" => "localhost.localdomain",
           "@version" => "1",
               "path" => "/elk/mysql.log",
         "@timestamp" => 2019-04-25T05:53:29.000Z,
           "clientip" => "172.1x.1x.1xx",
               "type" => "mysql-slow",
               "user" => "fof",
            "message" => "# Time: 2019-04-25T05:53:29.251666Z
# User@Host: fof[fof] @  [172.1x.1x.1xx]  Id:  3419
# Query_time: 0.437667  Lock_time: 0.000122 Rows_sent: 1000  Rows_examined: 1000
SET timestamp=1556171609;
SELECT * FROM `tb_` LIMIT 0, 1000;",
               "tags" => [
          [0] "multiline"
      ],
                "sql" => "SELECT * FROM `tb_` LIMIT 0, 1000;",
          "rows_sent" => 1000,
             "row_id" => 3419,
      "rows_examined" => 1000,
         "query_time" => 0.437667
  }