grok 正则解析日志例子<1>

<pre name="code" class="html">下面是日志的样子
55.3.244.1 GET /index.html 15824 0.043

正则的例子
%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}

配置文件里是怎么写得？ 

input {
  file {
    path => “/var/log/http.log”
  }
}
filter {
  grok {
    match => [ "message", "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" ]
  }
}

解析后，是个什么样子？ 

client: 55.3.244.1
method: GET
request: /index.html
bytes: 15824
duration: 0.043

/*********1

zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat log01.conf 
input {
  file {
    path => "/var/log/http.log"
  }
}


output {
 stdout {
  codec=>rubydebug{}
   }
 }
此时的输出
Pipeline main started
{
       "message" => "55.3.244.1 GET /index.html 15824 0.043",
      "@version" => "1",
    "@timestamp"