logstash日志处理

1.日志格式：

[2018-11-24 08:33:43,253][ERROR][http-nio-8080-exec-4][com.hh.test.logs.LogsApplication][code:200,msg:测试录入错误日志,param:{}]

处理：

filter {
  if "nova" in [tags]{
    grok {
      # 筛选过滤
      match => {
        "message" => "(?<date>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2},\d{3})\]\[(?<level>[A-Z]{4,5})\]\[(?<thread>[A-Za-z0-9/-]{4,40})\]\[(?<class>[A-Za-z0-9/.]{4,40})\]\[(?<msg>.*)"
      }
    mutate {
      remove_field => [
        "message",
      ]
    }
    # 不匹配正则则删除，匹配正则用=~
    if [level] !~ "(ERROR|WARN|INFO)" {
      # 删除日志
      drop {}
    }
  }
}