logstash配置

input
{
    beats
    {
        ssl => false
        host => "0.0.0.0"
        port => 5044
    }
    gelf
    {
        host => "0.0.0.0"
        port => 12201
    }
    http
    {
        ssl => false
        host => "0.0.0.0"
        port => 8888
    }
    tcp
    {
        mode => "server"
        host => "0.0.0.0"
        port => 5043
codec => multiline { 
                        pattern => "^%{TIMESTAMP_ISO8601} " 
                        negate => true 
                        what => previous
}
    }
    udp
    {
        host => "0.0.0.0"
        port => 5000
    }
}


filter
{


    grok {
match => [
"message" , "%{TIMESTAMP_ISO8601:logtime} %{WORD:level} %{WORD:lottery}.%{WORD:source} %{WORD:event} %{NUMBER:duration:float} %{NUMBER:rows:float}",
"message" , "%{TIMESTAMP_ISO8601:logtime} %{WORD:level} %{WORD:lottery}.%{WORD:source} %{WORD:event} %{NUMBER:duration:float} %{URI:uri}",
"message" , "%{TIMESTAMP_ISO8601:logtime} %{WORD:level} %{WORD:lottery}.%{WORD:source} %{WORD:event} %{NUMBER:duration:float}"
]
#remove_field => [ "message" ] 
}
date {
#locale => "cn"
#match => ["logtime", "TIMESTAMP_ISO8601"]
match => ["logtime", "yyyy-MM-dd'T'HH:mm:ss,SSS"]
#target => "logtime"
#remove_field => [ "logtime" ]
}
#mutate {

#}
}


output
{


    elasticsearch
    {
        hosts => ["127.0.0.1:9200"]
        #document_id => "%{logstash_checksum}"
        index => "logstash-%{+YYYY.MM.dd}"
    }
            
}