logstash 内置匹配IP 

10.252.142.174 - - [06/Sep/2016:08:41:36 +0800] "GET /api/validate/code/send?mobilePhone=18652221499&messageType=1&_=1454297673274 HTTP/1.1" 200 52 0.010 112.17.240.27



模式；
%{IPORHOST:clientip}\s+\-\s+\-\s+\[%{HTTPDATE:time}\].*


输出:
{
  "clientip": [
    [
      "10.252.142.174"
    ]
  ],
  "time": [
    [
      "06/Sep/2016:08:41:36 +0800"
    ]
  ]
}

posted @ 2016-09-06 22:11  czcb  阅读(297)  评论(0)  编辑  收藏  举报