logstash收集***日志只过滤出用户名和时间和ip的规则

***日志过滤规则，只取需要的数据

input {              
  file {
      path => "/etc/***/***.log"
      start_position => "beginning"
       }
}
filter {  
      grok {
match => ["message","%{WORD:TIME} %{WORD:TIME} %{MONTHDAY:TIME} %{TIME:TIME} %{YEAR:TIME} %{USERNAME:NAME}/%{IPV4:login}:%{NUMBER} MULTI_sva: pool returned IPv4=%{IPV4:***ip}*"]
 }
      if ([message]  =~ "Delayed|PLUGIN_CALL|Permission|timeout|Connection|PUSH|send_push_reply|CONTROL|OPTIONS|established|POST|Initial|PF|Channel|TLS|primary|authentication|received|Learn") {
      drop {}
  }
 
}
output {            
   elasticsearch
   {
   hosts => "10.25.4.93:9200"
   action => "index"
   index => "***"
   }
#stdout {
# codec => rubydebug
#       }
}