input{
beats {
port => "9988"
}
}
filter{
grok{
match => [
"message" , "%{TIMESTAMP_ISO8601:time} %{DATA:thread} %{LOGLEVEL:level} %{JAVACLASS:class} : %{GREEDYDATA:info}",
"message" , "%{TIMESTAMP_ISO8601:time} %{DATA:thread} %{LOGLEVEL:level} %{JAVACLASS:class} : %{GREEDYDATA:info}",
"message" , "%{URIHOST:visitHost} - - \[%{HTTPDATE:time}\] \"%{CISCO_REASON:method} %{URIPATHPARAM:request} %{SYSLOGPROG:protocol}\" %{NUMBER:responseCode:int} %{NUMBER:responseTime:int}"
]
}
date {
match => [
"time", "dd/MMM/yyyy:HH:mm:ss Z",
"yyyy-MM-dd HH:mm:ss.SSS",
"yyyy-MM-dd HH:mm:ss"
]
target => "@timestamp"
locale => "cn"
}
mutate{
remove_field => ["@version","_score","_id","program","time","beat","offset","prospector","host","message","tags"]
}
}
output{
#file{path=>"/home/elk/out.log"}
stdout{codec=>rubydebug}
if [log_type] == "console" and [info] =~ /^\S/ {