Logstash-Filter插件配置

Date

input{
    stdin{}
}
output{
    stdout{
        codec => "json"
    }
}

grok

input {stdin{}}
filter {
    grok {
        match => {
            "message" => "\s+(?\d+(?:\.\d+)?)\s+"
        }
    }
}
output {stdout{codec => rubydebug}

Demo:
[root@localhost conf.d]# /usr/share/logstash/bin/logstash -f /usr/share/logstash/config/conf.d/groktest.conf 
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
The stdin plugin is now waiting for input:
begin 123.456 end
输出格式:
{
      "@timestamp" => 2017-02-17T03:05:30.424Z,
    "request_time" => "123.456",
        "@version" => "1",
            "host" => "localhost.localdomain",
         "message" => "begin 123.456 end"
}