nginx access log 时间替换:
[elk@node2 conf]$ cat logstash_nginx.conf
input {
file {
path=>["/home/elk/conf/nginx.txt"]
type=>"system"
}
}
filter {
mutate {
add_field =>["newmessage","%{type},%{message}"]
}
}
filter {
grok {
match => ["message", "\s*%{IPORHOST:clientip}\s+.*?\[%{HTTPDATE:time}\].*"]
}
date {
match => ["time", "dd/MMM/yyyy:HH:mm:ss Z"]
}
}
output {
stdout {
codec=>rubydebug{}
}
}
[elk@node2 conf]$ logstash -f logstash_nginx.conf
!!! Please upgrade your java version, the current version '1.7.0_45-mockbuild_2013_11_22_18_30-b00' may