logstash结合后台日志过滤用户操作信息

配置文件

input {
  file {
    path => ["F:/log/log_info.log"]
	#codec => plain{ charset => "GBK" }
	start_position => "beginning"
	stat_interval => "3"
  }
}

filter {
	
    grok {
		match => {
			"message" => "(?<systemlog>[\d\D]*)\|(?<actionCode>[\d\D]*)\|(?<infos>.+)"
		}
    }
	if [actionCode] != "001" {
		drop {}
	}
	json{
		source => "infos"
	}
	
	
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "logstash_index"
	document_type => "tomcat-catalina"
    #user => "elastic"
    #password => "changeme"
  }
  stdout {
	
  }
}