logstash解析tomcat的catalina.out日志

input {
file {
type => "erp_log"
path => "/var/log/nginx/catalina.out"
start_position => "beginning"
codec => multiline {
pattern => "^%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{HOUR}:?%{MINUTE}(?::?%{SECOND})"
negate => true
what => "previous"
}
}
}
output {
redis {
port => 6379
host => ["192.168.10.214"]
data_type => "list"
key => "erp-%{type}"
}
stdout {
codec => rubydebug
}
}
注：
negate => true：选项来指定任何不是以时间戳开始的行属于前行，也就是不匹配pattern的行都属于前行的内容的一部分。