logstash只有一个filter,怎么解析不同格式的日志呢?
filebeat同时收集laravel和nginx日志扔到logstash里打上不同tag,但是一个filter只能解析laravel的格式,怎么解析nginx呢?
附上logstash的配置
input {
beats {
port => 5044
}
}
filter {
grok {
match => [ "message","(?m)\[%{TIMESTAMP_ISO8601:logtime}\] %{WORD:env}\.(?<level>[A-Z]{4,5})\: %{GREEDYDATA:msg}" ]
}
}
output {
if [from] == 'laravel' {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "laravel_%{+YYYY.MM.dd}"
}
}
if [from] == 'nginx' {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "nginx_%{+YYYY.MM.dd}"
}
}
}