Logstash grok配置
logstash 配置 input { file { path => "/logs/*.log" #日志路径 codec => multiline { pattern => "^%{TIMESTAMP_ISO8601}" negate => true what => "previous" } } } filter { if [path] =~ "access" { mutate { replace => { type => "access" } } grok { match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{INT:cost} %{IP:remoteIp}:%{POSINT:remotePort} %{IP:localIp}:%{POSINT:localPort} %{PATH:uri} %{INT:httpCode}" } remove_field => ["message"] } } else if [path] =~ "server" { mutate...