logstash-tomcat.conf

input {
        file {
            codec => multiline {
                pattern => "^%{TIME}|%{SYSLOGTIMESTAMP_EXT}|Hibernate:|%{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY}|%{MONTHDAY}[./-]%{MONTH}[./-]%{YEAR}"

                patterns_dir => ["grok-patterns"]
                negate => true
                what => "previous"
            }
        discover_interval => 10
        # 配置业务类型，建议加前缀方便查询区分，比如：tomcat_xxx
        type => "tomcat_zxr"
        # 配置日志文件的地址，需要修改为实际目录
        path => ["/usr/local/tomcat/tomcat8-collect4/logs/ejcGathV2.log",
		  "/usr/local/tomcat/tomcat8-collect2/logs/ejcGathV2.log","/usr/local/tomcat/tomcat8-collect3/logs/ejcGathV2.log"]
        # 配置读取位置存放的文件目录，不同业务建议分别存储
        sincedb_write_interval => 1
        start_position => "beginning"
        stat_interval => 1
    }
}
filter {
        grok {
            patterns_dir => ["grok-patterns"]
            match => [
                #2016-04-26 18:44:13.885 [localhost-startStop-1] INFO c.k.modules.base.log.LogFileWriter - loginError LogFileWriter init......
                "message", "%{DATESTAMP_EXT:time} \[%{NOTSPACE:thread}\] %{LOGLEVEL:level} %{PROG:class} - %{LOGMSG:log_msg}",
                "message", " %{DATESTAMP_EXT:time} \[%{NOTSPACE:thread}\] %{LOGLEVEL:level}  %{PROG:class}\[%{NOTSPACE:className}\] - %{LOGMSG:log_msg}",
                "message", " %{DATESTAMP_EXT:time} \[%{NOTSPACE:thread}\] %{LOGLEVEL:level} %{PROG:class}\[%{NOTSPACE:className}\] - %{LOGMSG:log_msg}",
                #2016-04-28 09:28:35.744 [catalina-exec-55] ERROR o.h.e.jdbc.spi.SqlExceptionHelper - java.util.concurrent.CancellationException: Cancelled
                "message", "%{DATESTAMP_EXT:time} \[%{NOTSPACE:thread}\] %{LOGLEVEL:level} %{PROG:class} - %{LOGMSG:log_msg}",
                #2016-04-26 18:44:12.695 INFO net.spy.memcached.auth.AuthThread: Authenticated to /202.173.10.95:11210
                "message", "%{DATESTAMP_EXT:time} %{LOGLEVEL:level} %{PROG:class}: %{LOGMSG:log_msg}",
                #Apr 27, 2016 1:35:43 PM org.apache.catalina.core.StandardWrapperValve invoke
                "message", "%{SYSLOGTIMESTAMP_EXT:time} %{LOGMSG:msg}",
                #18:44:09,389 |-INFO in ch.qos.logback.classic.joran.action.ConfigurationAction - debug attribute not set
                "message", "%{TIME:time} \|-%{LOGLEVEL:level} in %{PROG_EXT:class} - %{LOGMSG:log_msg}"
            ]
	    tag_on_failure => []
        }
         grok {
            patterns_dir => ["grok-patterns"]
            match => ["log_msg", "%{EXCEPTIONTYPE:exception_type}"]
            match => ["log_msg", "%{OCR_REQUEST:ocr_req}"]
            match => ["log_msg", "%{OCR_RESPONSE:ocr_rep}"]
            match => ["log_msg", "%{JIYAN_REQUEST:jiyan_req}"]
            match => ["log_msg", "%{JIYAN_SUCCESS:jiyan_success}"]
        }
	if [ocr_req] =~ /^\S+/ {
	     mutate {
               add_field =>   {
                 "ocr" => "%{[ocr_req]}"      
               }
	    }
        }else if [ocr_rep] =~ /^\S+/ {
	     mutate {
               add_field =>   {
                 "ocr" => "%{[ocr_rep]}"
               } 
            } 
	}
#        mutate {
       #      remove_field => [ "log_msg"]
 #      	  add_field =>   { 
#		 "ocr" => "%{[ocr_req]}" 
#	  }
#	}





}


output {
	   stdout {
          codec => rubydebug
   }
   if [type] == "tomcat_zxr"  {
                elasticsearch {
                           manage_template => false
                           host => "192.168.0.7"
                           protocol => http
                           port => "9200"
                 }
    } 
}