logstash获取php_error.log,php-fpm.log,php-fpm-slow.log

php-fpm-slow.log的过滤配置如下：
filter {

  if [type] == "php-fpm-slow" {

    multiline {

      pattern => '^(\[0x0|script_filename|$)'

      what => 'previous'

      negate => false

    }

   grok {

      patterns_dir => '/usr/local/logstash/patterns'

      match => [

        "message", "%{PHP_FPM_SLOW_LOG}"

      ]

    }

  }

...

}

/usr/local/logstash/patterns/php-fpm的内容如下：

PHP_DATE_TIME %{MONTHDAY}-%{MONTH}-%{YEAR}\s+%{TIME}

PHP_FPM_SLOW_LOG_FIRST_LINE

 \[%{GREEDYDATA:php_fpm_pool}\] pid {POSINT}

PHP_FPM_SLOW_LOG ^

%{GREEDYDATA:func_name} %{UNIXPATH:script_path}