logstash解析系统的messages日志

logstash解析系统日志的写法，output中的stdout为调试，生产可以移除

input {
    redis {
        host => "192.168.1.181"
        port => 6379
        db => "0"
        data_type => "list"
        key => "815"
    }
}
filter {
    grok {
        match  => {
                "message" => "%{SYSLOGLINE}"
        }
    }
    mutate {
        remove_field => ["prospector","logsource","beat","[message][0]","offset","@version","input"]
    }
    date {
        match => ["timestamp","MMM dd HH:mm:ss"]
    }
    mutate {
        remove_field => ["timestamp"]
    }
}
output {
    elasticsearch {
        hosts  => ["10.78.1.184:9200","10.78.1.185:9200","10.78.1.188:9200"]
        index  => "message-%{+YYYY.MM.dd}"
    }
    stdout { codec => rubydebug }
}

转载于:https://blog.51cto.com/liuzhengwei521/2151159