From dca9a5aa86be8b26aa6e3d2e0efe90341b0588d1 Mon Sep 17 00:00:00 2001
From: v0112358 <ntv1090@gmail.com>
Date: Fri, 4 Jun 2021 14:03:08 +0700
Subject: [PATCH] Support parse Redis 5 logs

Signed-off-by: v0112358 <ntv1090@gmail.com>
---
 patterns/grok-patterns | 1 +
 patterns/redis         | 7 +++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/patterns/grok-patterns b/patterns/grok-patterns
index 1e99396..d15376e 100644
--- a/patterns/grok-patterns
+++ b/patterns/grok-patterns
@@ -7,6 +7,7 @@ BASE10NUM (?<![0-9.+-])(?>[+-]?(?:(?:[0-9]+(?:\.[0-9]+)?)|(?:\.[0-9]+)))
 NUMBER (?:%{BASE10NUM})
 BASE16NUM (?<![0-9A-Fa-f])(?:[+-]?(?:0x)?(?:[0-9A-Fa-f]+))
 BASE16FLOAT \b(?<![0-9A-Fa-f.])(?:[+-]?(?:0x)?(?:(?:[0-9A-Fa-f]+(?:\.[0-9A-Fa-f]*)?)|(?:\.[0-9A-Fa-f]+)))\b
+CHAR [a-zA-Z]
 
 POSINT \b(?:[1-9][0-9]*)\b
 NONNEGINT \b(?:[0-9]+)\b
diff --git a/patterns/redis b/patterns/redis
index 341a330..2ca8100 100644
--- a/patterns/redis
+++ b/patterns/redis
@@ -1,3 +1,6 @@
-REDISTIMESTAMP %{MONTHDAY} %{MONTH} %{TIME}
-REDISLOG \[%{POSINT:pid}\] %{REDISTIMESTAMP:timestamp} \* 
+REDISLEVEL [.\-*#]
+REDISTIMESTAMP1 %{MONTHDAY} %{MONTH} %{TIME}
+REDISTIMESTAMP2 %{MONTHDAY} %{MONTH} %{YEAR} %{TIME}
+REDISLOG \[%{POSINT:pid}\] %{REDISTIMESTAMP1:timestamp} \* 
 REDISMONLOG %{NUMBER:timestamp} \[%{INT:database} %{IP:client}:%{NUMBER:port}\] "%{WORD:command}"\s?%{GREEDYDATA:params}
+REDIS5LOG %{POSINT:pid}:%{CHAR:role} %{REDISTIMESTAMP2:timestamp} %{REDISLEVEL:log_level} %{GREEDYDATA:message}
\ No newline at end of file