logstash 解析日志文件

input {
  file {
    path => "/usr/local/test/log.log"
  }

}
filter {
    grok {
match => { "message" => "%{TIMESTAMP_ISO8601:time} %{NUMBER:total_time} (?<req_id>([0-9a-zA-Z]*)) --app (?<app_id>([0-9a-zA-Z]*)) %{IP:ip} (?<req_port>([0-9]*)|[\s\S])
 %{WORD:method} %{URIPATHPARAM:req_path} %{NUMBER:resp_code} --svc (?<svc_id>([0-9a-zA-Z]*)) (?<sub_services>[\s\S]*)"}
    }
ruby{
code => "
            array=event.get('sub_services').split(']')
            index=0 
            array.each do |value|
                index=index+1
                tem='service'+index.to_s
                value=value+']'
                event.set(tem,value)
            end
        "
}
}
output {
         mongodb{
        collection => "testlog"
        database => "test"        
        uri => "mongodb://192.168.1.203:27017"

    }
}