五分钟带你玩转Elasticsearch（十）企业实战——使用logstash监控多服务器并获取日志

input{
        tcp {
          mode => "server"
        host => "0.0.0.0"
                port => 5000
                codec => json_lines
        type=> "A"
        }
    tcp {
          mode => "server"
        host => "0.0.0.0"
                port => 4999
                codec => json_lines
        type=> "B"
        }
}
filter{
    if[type] == "A"{
      if([message] =~  "^(?!.*?登录日志).*$") {
        ### 丢弃
        drop{}
         }
      }
}
output{
        if[type] == "A"{
            elasticsearch{
            hosts=>["192.168.4XX.XX:9200"]
            index => "A-%{+YYYY.MM.dd}"
                }
            }
        if[type] == "B"{
            elasticsearch{
            hosts=>["192.168.XX.XX:9200"]
            index => "B-%{+YYYY.MM.dd}"
                  }         
                        }
}