"message" => " 10.168.255.134 [12/Sep/2016:16:30:40 +0800] "GET /resources/plugins/artDialog/dialog-min.js?v=1&_=1473669040515 HTTP/1.1" - 200 9946 "https://wenjinbao.winfae.com/forgetPassword.html" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" 0.001 115.234.183.214",
"@version" => "1",
"@timestamp" => "2016-09-12T08:31:06.630Z",
"path" => "/data01/applog_backup/winfae_log/wj-frontend01-access.2016-09-12",
"host" => "dr-mysql01.zjcap.com",
"type" => "wj_frontend_access",
"clientip" => "10.168.255.134",
"time" => "12/Sep/2016:16:30:40 +0800",
filter {
grok {
match =>[
"message","%{IPORHOST:clientip} [%{HTTPDATE:time}] "%{WORD:verb} %{URIPATHPARAM:request}?.* HTTP/%{NUMBER:httpversion}" - %{NUMBER:http_status_code} %{NUMBER:bytes} "(?<http_referer>S+)" "(?<http_user_agent>(S+s+)*S+)" (%{BASE16FLOAT:request_time}) (%{IPORHOST:http_x_forwarded_for}|-)",
"message" , "%{IPORHOST:clientip} [%{HTTPDATE:time}] "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" - %{NUMBER:http_status_code} %{NUMBER:bytes} "(?<http_referer>S+)" "(?<http_user_agent>(S+s+)*S+)" (%{BASE16FLOAT:request_time}) (%{IPORHOST:http_x_forwarded_for}|-)"
]
}
geoip {
source => "http_x_forwarded_for"
target => "geoip"
database => "/usr/local/logstash-2.3.4/etc/GeoLiteCity.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
convert => [ "[geoip][coordinates]", "float"]
convert => [ "request_time", "float"]
add_field =>["response_time","%{request_time}"]
convert => [ "response_time", "float"]
remove_field =>["request_time"]
}
date {
match => ["time", "dd/MMM/yyyy:HH:mm:ss Z"]
}
}
"message" => " 10.171.246.184 [12/Sep/2016:22:26:47 +0800] "GET /resources/images/icon/icon_stock.6fe20e7d.png HTTP/1.1" - 200 20528 "https://www.zjcap.cn/resources/css/index.css?06212016" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36" 0.001 122.235.174.156",
"@version" => "1",
"@timestamp" => "2016-09-12T14:26:47.000Z",
"path" => "/data01/applog_backup/zjzc_log/zj-frontend01-access.2016-09-12",
"host" => "dr-mysql01.zjcap.com",
"type" => "zj_frontend_access",
"clientip" => "10.171.246.184",
"time" => "12/Sep/2016:22:26:47 +0800",
实时数据处理的时候同样有效，因为一般情况下数据流程中我们都会有缓冲区，导致最终的实际处理时间跟事件产生时间略有偏差。