input {
file {
path => "/usr/local/test/log.log"
} }
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:time} %{NUMBER:total_time} (?<req_id>([0-9a-zA-Z]*)) --app (?<app_id>([0-9a-zA-Z]*)) %{IP:ip} (?<req_port>([0-9]*)|[\s\S])
%{WORD:method} %{URIPATHPARAM:req_path} %{NUMBER:resp_code} --svc (?<svc_id>([0-9a-zA-Z]*)) (?<sub_services>[\s\S]*)"}
}
ruby{
code => "
array=event.get('sub_services').split(']')
index=0
array.each do |value|
index=index+1
tem='service'+index.to_s
value=value+']'
event.set(tem,value)
end
"
}
}
output {
mongodb{
collection => "testlog"
database => "test"
uri => "mongodb://192.168.1.203:27017" }
}
05-11 17:49