有些日誌(好比apache)不像nginx那樣支持json可使用grok插件html
grok利用正則表達式就行匹配拆分python
預約義的位置在nginx
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-2.0.5/patterns正則表達式
apache的在文件grok-patterns redis
查看官方文檔apache
https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.htmljson
vim /etc/logstash/conf.d/grok.confvim
input{ stdin{} } filter { grok { match => { "message" => "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" } } } output{ stdout{ codec => rubydebug } }
啓動ruby
/opt/logstash/bin/logstash -f grok.confide
標準輸入文本 55.3.244.1 GET /index.html 15824 0.043
輸出
PS:grok很是影響性能,不靈活,可使用logstash - redis - python -es
vim apache_grok.conf
input{ stdin{} } filter{ grok{ match => { "message" => "%{HTTPD_COMBINEDLOG}" } } } output{ stdout{ codec => rubydebug } }
運行輸出
/opt/logstash/bin/logstash -f apache_grok.conf