标签：hosts spec search sea 移除 ast line remove codec
logstash解析系统日志的写法，output中的stdout为调试，生产可以移除input {
redis {
host => "192.168.1.181"
port => 6379
db => "0"
data_type => "list"
key => "815"
}
}
filter {
grok {
match => {
"message" => "%{SYSLOGLINE}"
}
}
mutate {
remove_field => ["prospector","logsource","beat","[message][0]","offset","@version","input"]
}
date {
match => ["timestamp","MMM dd HH:mm:ss"]
}
mutate {
remove_field => ["timestamp"]
}
}
output {
elasticsearch {
hosts => ["10.78.1.184:9200","10.78.1.185:9200","10.78.1.188:9200"]
index => "message-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
标签：hosts spec search sea 移除 ast line remove codec
原文地址：http://blog.51cto.com/liuzhengwei521/2151159
