logstash %{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}

如果你希望转换一个语义的数据类型,比如

改变一个字符串为一个整型,然后在其后面添加目标数据类型

例如 %{NUMBER:num:int} 会转换一个字符串为一个整型  

例子, 有了语法和语义的概念,可以从示例日志中提取有用的字段，如以下虚构的http请求日志：

55.3.244.1 GET /index.html 15824 0.043

模式可以是:

%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}

[elk@node2 conf]$ logstash -f logstash05.conf 
!!! Please upgrade your java version, the current version '1.7.0_45-mockbuild_2013_11_22_18_30-b00' may cause problems. We recommend a minimum version of 1.7.0_51
Settings: Default pipeline workers: 4
Pipeline main started
{
       "message" => "55.3.244.1 GET /index.html 15824 0.043",
      "@version" => "1",
    "@timestamp" => "2020-10-06T12:01:37.503Z",
          "path" => "/home/elk/conf/test.txt",
          "host&