logstash grok配置

input{
    file{
        path => "/var/log/es_api.log"
        start_position => "beginning"
        type => "es_api_log"
    }
}
filter{
	if [type]=="es_api_log"{
		 grok{
			match => {"message" => "(?<date>.+\s.+)///%{DATA:desc}///%{NUMBER:module}///%{NUMBER:point}///%{NUMBER:user}///%{DATA:account}///%{NUMBER:bundle}///%{DATA:ip}///%{DATA:position}///%{DATA:device}///%{DATA:graphics}///%{WORD:invite}///%{NUMBER:country}///%{WORD:token}"}
		}
		mutate{
			remove_field => ["message"]
		}
	}
}
output{
	if [type]=="es_api_log"{
		elasticsearch {      
			hosts => "120.55.101.231:9200"
			index => "es_api_log"   
		}
	}
}