五分钟带你玩转Elasticsearch（十）企业实战——使用logstash监控多服务器并获取日志

input{
        tcp {
                mode => "server"
                host => "0.0.0.0"
                port => 5000
                codec => json_lines
                type=> "A"
        }
        tcp {
                mode => "server"
                host => "0.0.0.0"
                port => 4999
                codec => json_lines
                type=> "B"
 
        }
}
filter{
        if[type] == "A"{
            if([message] =~  "^(?!.*?登录日志).*$") {
                ### 丢弃
                drop{}
               }
            }
}
output{
       
                if[type] == "A"{
                    elasticsearch{
                        hosts=>["192.168.4XX.XX:9200"]
                        index => "A-%{+YYYY.MM.dd}"
                            }
                        }
                if[type] == "B"{
                    elasticsearch{
                        hosts=>["192.168.XX.XX:9200"]
                        index => "B-%{+YYYY.MM.dd}"
                            }                   
                        }
}