qq79428316/logstash repository overview

docker run \
    -d \
    --name=dev-logstash \
    --restart always \
    --network=host \
    -v /data/usr-data/logstash:/data/usr-data/logstash \
    -v /data/usr-data/logstash/pipelines.yml:/usr/share/logstash/config/pipelines.yml \
    -v /etc/timezone:/etc/timezone \
    -v /etc/localtime:/etc/localtime \
    -e PATH_DATA="/data/usr-data/logstash/data" \
    -e PATH_LOGS="/data/usr-data/logstash/logs" \
    -e LOG_LEVEL="info" \
    -e XPACK_MONITORING_ELASTICSEARCH_URL="http://es-1.example.com:9200" \
    -e CONFIG_RELOAD_AUTOMATIC="true" \
    qq79428316/logstash:6.3.0

- pipeline.id: nginx-logs
  queue.type: persisted
  path.config: "/data/usr-data/logstash/nginx"

input {
    beats {
        port => "5044"
    }
}
filter {
    date {
        match => [ "time_local", "dd/MMM/yyyy:HH:mm:ss Z" ]
        target => "@timestamp"
        remove_field => [ "beat","input","prospector" ]
    }
    useragent {
        source => "http_user_agent"
        target => "useragent"
    }
    dissect {
        mapping => { 
            "request" => "%{request_method} %{request_url} %{request_version} " 
        }
    }
    geoip {
        source => "remote_addr"
    }
    mutate {
        gsub => [
            "request_url","\?\S*",""
        ]
    }
}
output {
    elasticsearch { 
        hosts => ["http://es-1.example.com:9200",
                  "http://es-2.example.com:9200"]
        index => "nginx-logs-%{+yyyy.MM}"
    }
}