input {
file {
path => "/opt/logstash/config/aa.log" #配置讀取的文件
start_position => "beginning" #從文件開始位置讀取
discover_interval => 5 #設置logstash讀取新文件的時間間隔
max_open_files => 10 #配置當前input可以監控的文件的最大值
close_older => 3600 #結束時間，即如果在限制時間段內沒有更新內容，就關閉監聽它的文件句
柄
sincedb_path => "/data/sincedb_test.txt" #記錄讀取的位置
sincedb_write_interval => 15
codec => json { #配置文本類型
charset => "UTF-8"
}
}
}
filter {
if "M00002" in [message] {
mutate {
split => ["message", "|"] #原始日志按"|"切割
add_field => { #增加字段，對字段命名
"timestamp" => "%{message[0]}"
"thread" => "%{message[1]}"
"loglevel" => "%{message[2]}"
"class" => "%{message[3]}"
"aa" => "%{message[4]}"
"bb" => "%{message[5]}"
"modelid" => "%{message[6]}"
"cc" => "%{message[7]}"
"dd" => "%{message[8]}"
"ee" => "%{message[9]}"
"ff" => "%{message[10]}"
}
remove_field => ["message"] #刪除原始字段
}
}
else {
mutate {
split => ["message", "|"] #原始日志按"|"切割
add_field => { #增加字段，對字段命名
"timestamp" => "%{message[0]}"
"thread" => "%{message[1]}"
"loglevel" => "%{message[2]}"
"class" => "%{message[3]}"
"aa" => "%{message[4]}"
"bb" => "%{message[5]}"
"modelid" => "%{message[6]}"
"cc" => "%{message[7]}"
"dd" => "%{message[8]}"
"ee" => "%{message[9]}"
"ff" => "%{message[10]}"
}
remove_field => ["message"] #刪除原始字段
}
}
date { # 日期格式化
match => ["timestamp", "ISO8601"]
}
}
output {
file {
path => "/opt/logstash/config/bb.txt" #輸出到一個文件內
}
stdout{codec => rubydebug}
}
