【ELK】Logstash 配置小记

grok {
    match => [ "message" , "%{NGINXLOG} %{QS:upstream_addr} %{QS:upstream_response_time} %{QS:request_time} %{QS:body}"]
}

# 自定义正则匹配
grok {
    break_on_match => "false"
    patterns_dir => "./logstash/pat"
    match => [ "request" , "%{URIMATCH}" ]
}

ruby {
    code => "event.set(‘timelocal‘, event.get(‘@timestamp‘).time.localtime + 8*60*60)"
}
ruby {
    code => "event.set(‘@timestamp‘,event.get(‘timelocal‘))"
}
ruby {
    code => "event.set(‘timeunix‘,event.get(‘@timestamp‘).to_i)"
}

kv {
    source => "message"
    field_split => "#"
    value_split => "~"
    target => "msg_json"

}

date {
    match => ["timestamp", "UNIX"]
    remove_field => ["message","timestamp", "count", "fields", "input_type", "offset"]
}

mutate {
    lowercase => [ "loglevel" ]
    remove_field => [ "ident", "auth", "source", "beat", "message", "@version", "count", "fields", "input_type", "offset" ]
}

if "_grokparsefailure" not in [tags]

过滤掉匹配失败的日志