Logstash configuration file processing time log

The SpringBoot log files generated by the transmission to Logstash Elasticsearch. Log file content format as follows

2019-11-1222: 01: 23.358 call ==> User Log interface parameters => "{\" phone \ ": \" 17010058888 \ ", \" token \ ": \" oo: 8da500acb09d7e3ef2e9e61dcc6b5908 \ "}"

Write logstash.conf file, as follows, to convert the timestamp to timestamp log print type

input {
    file {
        type => "auth_log"
        path => ["/logs/auth.log"]
        start_position => "beginning"
        sincedb_path => "/dev/null"
    }
}

filter {
        grok {
          match => { "message" => "\s*%{TIMESTAMP_ISO8601:time}\s*%{NOTSPACE:rest}" }
        }
        date {
          match => ["time", "yyyy-MM-dd HH:mm:ss.SSS"]
          target => "@timestamp"
        }
        mutate {
          remove_field =>["message"]
        }
}
output {
  elasticsearch {
    hosts => "ip:9200"
    index => "logstash-%{+YYYY.MM.dd}"
  }
}

 

 

Guess you like

Origin www.cnblogs.com/yangjiming/p/11846085.html
Recommended