logstash 接收 http 数据

split => { "message" => "\n" }

input {

  http {

    host => "10.17.64.126"

    port => 12366

    codec => "plain"

    additional_codecs => {"text/plain"=>"plain"}

    threads => 4

    ssl => false

 }

}



filter {

  mutate {

    split => ["message", "\t"]

    add_field => {

      "ftimeold" => "%{[message][0]}"

    }

    add_field => {

      "serverold" => "%{[message][1]}"

    }

    add_field => {

      "logname" => "%{[message][2]}"

    }

    add_field => {

      "title" => "%{[message][3]}"

    }

     add_field => {

      "info_version" => "%{[message][4]}"

    }

     add_field => {

      "uid" => "%{[message][5]}"

    }

     add_field => {

      "role_id" => "%{[message][6]}"

    }

     add_field => {

      "batid" => "%{[message][7]}"

    }

  }

 }

 

 output {

  stdout{codec => json}

 }