input{
beats{
port => 5044
}
}
filter{
grok {
match => { "message" => [
"%{NOTSPACE:applicationName} %{NOTSPACE:instanceName} %{TIMESTAMP_ISO8601:[@metadata][timestamp]} \[%{NOTSPACE:sessionid}\] \[%{NOTSPACE:requestid}\] %{LOGLEVEL:level} %{JAVACLASS:class} - (?<logmessage>(.*))"
]
}
}
date {
match => [ "[@metadata][timestamp]", "yyyy-MM-dd HH:mm:ss.SSS" ]
}
geoip {
source => "remote_addr_ip"
}
}
output{
elasticsearch{
hosts => ["xx:xx"]
index => "iflydocs-log-index-%{+YYYY.MM.dd}"
}
}
默认生成timestamp字段,这里通过配置date将日志中的timestamp覆盖自动生成的timestamp,即elk查询到的timestamp就是日志发生的时间