案例 日志格式:

  • | - | 08/Mar/2018:03:31:14 +0800 匹配配置文件: input {
    stdin {
    } }
    filter { grok { match => [ "message", "%{USER} | %{USER} | %{HTTPDATE:timestamp}" ] } date { match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ] locale => "en" } } output { stdout {
    codec=>rubydebug{}
    } }