1 2 3 4 5 6 7 8 9 10 11 12 | { "status" : 200, "name" : "Thundra", "version" : { "number" : "1.3.4", "build_hash" : "a70f3ccb52200f8f2c87e9c370c6597448eb3e45", "build_timestamp" : "2014-09-30T09:07:17Z", "build_snapshot" : false, "lucene_version" : "4.9" }, "tagline" : "You Know, for Search" } |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | input { tcp { port => 5000 type => syslog } } filter { grok { match => { "message" => "%{SYSLOG5424PRI}%{NONNEGINT:syslog5424_ver} +(?:%{TIMESTAMP_ISO8601:syslog5424_ts}|-) +(?:%{HOSTNAME:syslog5424_host}|-) +(?:%{NOTSPACE:app_id}|-) +(?:%{NOTSPACE:syslog5424_proc}|-) +(?:%{WORD:syslog5424_msgid}|-) +(?:%{SYSLOG5424SD:syslog5424_sd}|-|) +%{CLOUDFOUNDRYAPP:syslog5424_msg}" } add_field => { "format" => "cf" } } } output { elasticsearch { host => localhost protocol => http } stdout { codec => rubydebug } } |
1 2 | CLOUDFOUNDRYAPP %{NOTSPACE:domain} - \[%{NOTSPACE:timex} %{NOTSPACE:milis}\] "%{HTTPMETHOD:httpmethod} %{PATH:path} %{NOTSPACE:protocol}" %{INT:response_code} %{INT:not_sure_todo} HTTPMETHOD (GET|PUT|POST|DELETE) |
欢迎光临 电子技术论坛_中国专业的电子工程师学习交流社区-中电网技术论坛 (http://bbs.eccn.com/) | Powered by Discuz! 7.0.0 |