一，Logstash正则匹配redis日志及时间戳

一，Logstsh日志时间字段及正则匹配

例：redis

if "redis"  in [tags] {
        grok {
        #正则匹配
        match => [ "message", "(?<pid>.\d+?):(?<role>\w?)\s+(?<logdate>%{MONTHDAY}\s+%{MONTH}\s+%{HOUR}:%{MINUTE}:%{SECOND}?)\s+(?<log_level>.?)\s%{GREEDYDATA:message}" ]
            #overwrite => [ "message" ]
    }
    #根据log_level字段符号替换为相应的级别
    if [log_level] == "*" {
        mutate{ update => {"log_level" => "NOTICE"}}
        }

        if [log_level] == "#" {
            mutate{ update => {"log_level" => "WARNING"}}
        }

        if [log_level] == "-" {
            mutate{ update => {"log_level" => "VERBOSE"}}
        }

        if [log_level] == "." {
            mutate{ update => {"log_level" => "DEBUG"}}
        }
    #根据redis日志中的时间格式修改替换elk中默认的时间字段
    date {
                match => [ "logdate", "dd MMM HH:mm:ss", "dd MMM HH:mm:ss.SSS" ]
        remove_field => [ "logdate" ]
        }
}