logstach http input

input {
    http{
        host => "0.0.0.0"
        #http启动端口
        port => 8088
        #接受JSON数据
        additional_codecs => {"text/plain"=>"json"}
        codec => "plain"
        #线程数
        threads => 8
        #关闭ssl
        ssl => false
    }
}
filter{
    json {
        source => "message"
        remove_field=>["message","@version","@timestamp","host","headers"]
    }
    ruby {
        code => '
            if event.get("id")<10 then
                event.set("flag","1")
            else
                event.set("flag","2")
            end
        '
    }
}
output {
    if [flag] =="1" {
        stdout {
            codec => line{format => "ID小于10"}
        }            
    }    
    if [flag] =="2" {
        stdout {
            codec => line{format => "ID大于10"}
        }
    }
}

 

请求方式：

POST http://x.x.x.x:8088/

{"id":1,"name":"abc"}