案例
日志格式：

  • | - | 08/Mar/2018:03:31:14 +0800
    匹配配置文件：
    input {
    stdin {
    }
    }
    filter {
    grok {
    match => [
    "message", "%{USER} | %{USER} | %{HTTPDATE:timestamp}"
    ]
    }
    date {
    match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
    locale => "en"
    }
    }
    output {
    stdout {
    codec=>rubydebug{}
    }
    }

参考博文：http://blog.csdn.net/zhaoyangjian724/article/details/52523385