logstash 解析日志文件

input {

  file {

    path => "/usr/local/test/log.log"

  }

}

filter {

    grok {

match => { "message" => "%{TIMESTAMP_ISO8601:time} %{NUMBER:total_time} (?<req_id>([0-9a-zA-Z]*)) --app (?<app_id>([0-9a-zA-Z]*)) %{IP:ip} (?<req_port>([0-9]*)|[\s\S])

 %{WORD:method} %{URIPATHPARAM:req_path} %{NUMBER:resp_code} --svc (?<svc_id>([0-9a-zA-Z]*)) (?<sub_services>[\s\S]*)"}

    }

ruby{

code => "

            array=event.get('sub_services').split(']')

            index=0

            array.each do |value|

                index=index+1

                tem='service'+index.to_s

                value=value+']'

                event.set(tem,value)

            end

        "

}

}

output {

         mongodb{

        collection => "testlog"

        database => "test"

        uri => "mongodb://192.168.1.203:27017"

    }

}