input {
        file {
                # 日志文件路径
                path => "/a/b/c_*.log"
                #path => "/home/test_lek.log"
                # 可以为不同的输入设置不同的type
                type => "c"
        }
        file {
                path => "/a/b/e_*.log"
                type => "e"
        }
}

filter {
        # 过滤掉不符合格式的行
        if [message] !~ "^\d{4}\/\d{2}\/\d{2}-\d{2}:\d{2}:\d{2}*" {
                drop {}
        }

        # grok正则解析, 其中DATETIME/SOMETHING都是自定义的正则公式, 存放在patterns/extra文件中, logstash也有内置的一些正则公式, 比如NUMBER
        grok {
                match => {"message" => "%{DATETIME:tmp_timestamp}\s\[%{SOMETHING:thread}\]\s%{SOMETHING:log_level}\s%{SOMETHING:cls}\s%{SOMETHING:something}\s%{SOMETHING:something}\s%{ANYTHING:text}"}
        }

        if [text] =~ "^\{.*\}$" {
                # json解析
                json {
                        source => "text"
                        target => "o" # 不指定target则解析出来的字段将作为顶级属性
                        add_tag => ["json"]
                }
        } else if [text] =~ "^\[POST\s\/rest\/gifts\]\sGift request\s*" {
                grok {
                        match => {"text" => "\[POST\s\/rest\/gifts\]\sGift request\s->\s%{ANYTHING:GiftRequest}"}
                }
                json {
                        source => "GiftRequest"
                        target => "GiftRequest"
                        add_tag => ["GiftRequest"]
                }
        }

        date {  
                # 将tmp_timestamp字段解析为日期类型，并赋值给 @timestamp
                match => [ "tmp_timestamp" , "yyyy/MM/dd-HH:mm:ss" ]
        }

        if "json" in [tags] {
                mutate {
                        add_field => {
                                # 地理位置解析，es进行存储的时候geoip[location]字段作为geoip类型
                                "[geoip][location][lat]" => "%{o[Latitude]}"
                                "[geoip][location][lon]" => "%{o[Longitude]}"
                        }
                }
        }

}

output {
        elasticsearch {
                hosts => ["x.x.x.x"]
                # 按日期创建索引
                index => "a-b-%{+YYYY.MM.dd}"
        }
        # 一般调试时时使用
        stdout { codec => rubydebug }
}