通过配置logstash，将六行日志合并为一行呢

input {

    file {

        path => "/opt/es/tmp/test/*"

        codec => multiline {

          pattern => ".*请求URL.*"

          negate => true

          what => "previous"

        }

    }

}

output {

    elasticsearch {

        hosts => ["http://10.0.0.200:9200"]

        index => "test-index"

    }

}

[2019-08-23T01:30:00,016][INFO ] 请求URL：www.example.com

[2019-08-23T01:30:00,016][INFO ] 请求IP：192.168.0.122

[2019-08-23T01:30:00,016][INFO ] 请求方法： GET

[2019-08-23T01:30:00,016][INFO ] 请求参数： {"test": "xxx"}

[2019-08-23T01:30:00,016][INFO ] 请求URL：www.example.com

[2019-08-23T01:30:00,016][INFO ] 请求IP：192.168.0.123

[2019-08-23T01:30:00,016][INFO ] 请求方法： POST

[2019-08-23T01:30:00,016][INFO ] 请求参数： {"test": "xxx"}

      {

        "_index" : "test-index",

        "_type" : "doc",

        "_id" : "rzPOvWwBZFTn6WUnbRUg",

        "_score" : 1.0,

        "_source" : {

          "@version" : "1",

          "host" : "ecs-aaaaaa",

          "path" : "/opt/es/tmp/test/data.log",

          "message" : """

[2019-08-23T01:30:00,016][INFO ] 请求URL：www.example.com

[2019-08-23T01:30:00,016][INFO ] 请求IP：192.168.0.122

[2019-08-23T01:30:00,016][INFO ] 请求方法： GET

[2019-08-23T01:30:00,016][INFO ] 请求参数： {"test": "xxx"}

""",

          "@timestamp" : "2019-08-23T09:28:37.641Z",

          "tags" : [

            "multiline"

          ]

        }

      },