Logstash解析日志文件—包含json内容

由于业务需要，Logstash采集日志文件内容输出到Elasticsearch

1.日志格式样例：

2019/10/09 05:05:46 [INFO] [Log.go:67]   {"name":"SKT002","Type":"Face","UUID":"dasdasdasda"}

2.logstash.con配置文件

input {
	beats {
        port => "5044"
		codec=>plain{ charset=>"UTF-8" }
    }
	#stdin{}
}

filter{
	
	grok{
			match => { "message" => "(?<log_timestamp>\d{4}/\d{2}/\d{2}\s\d{2}:\d{2}:\d{2}) \[\s*(?<level>([\s\S]*))\] \[\s*(?<class>([\s\S]*))\] (.*?)\s*(?<Msg>(.*))" }
			overwrite => ["message"]
			remove_field => ["host","beat","offset"]
	}
	
	json{
        source => "Msg"
        #target => "jsoncontent"
    }

    mutate {
        remove_field => ["Msg"]
    }
}

output {
	stdout {  
		codec => rubydebug
	}
	
	if "_jsonparsefailure" not in [tags] {
		elasticsearch {
			hosts=>["172.20.32.241:9200"]
			index => "test-%{+YYYY.MM.dd}"
		}
	}
}

3.运行输出：

4. Head插件查询：