Date
input{
stdin{}
}
output{
stdout{
codec => "json"
}
}
grok
input {stdin{}}
filter {
grok {
match => {
"message" => "\s+(?<request_time>\d+(?:\.\d+)?)\s+"
}
}
}
output {stdout{codec => rubydebug}
Demo:
[root@localhost conf.d]# /usr/share/logstash/bin/logstash -f /usr/share/logstash/config/conf.d/groktest.conf
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
The stdin plugin is now waiting for input:
begin 123.456 end
输出格式:
{
"@timestamp" => 2017-02-17T03:05:30.424Z,
"request_time" => "123.456",
"@version" => "1",
"host" => "localhost.localdomain",
"message" => "begin 123.456 end"
}
