logstash直接获取日志

input {
file {
type => “java-log”
path => “/opt/elk-example.log”
codec => multiline {
pattern => “^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME}.*”
negate => “true”
what => “previous”
}
start_position => “beginning”
}
}

filter {
grok{
match => {
“message” => “(?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3}) INFO %{NUMBER:thread} — %{SYSLOG5424SD:task} %{JAVACLASS:javaclass}\s*: %{SYSLOG5424SD:module}\s*%{GREEDYDATA:msg}”
}
} ### 通过grok匹配内容并将

    date{
            match => ["datetime","yyyy-MM-dd HH:mm:ss.SSS","yyyy-MM-dd HH:mm:ss.SSSZ"]
            target => "@timestamp"
    } ### 处理时间

}

output {

stdout {
codec => rubydebug
}

Sending properly parsed log events to elasticsearch

elasticsearch {
hosts => [“192.168.1.211:9200”]
index =>“javalog-%{+YYYY.MM}”
}
}