Logstash解析Nginx访问日志

Nginx日志格式

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" '
                        '"$http_host" "$request_time" "$upstream_response_time" $http_device $http_appversion $upstream_addr '
                      '$http_openudid $http_code $http_networkType "$http_deviceModel" "$http_osversion"';

解析格式为

%{IPORHOST:Client_IP} (%{NGUSER:ident}|-) (%{NGUSER:auth}|-) \[%{HTTPDATE:timestamp}\] "%{WORD:Http_Method} %{URIPATHParaM:HTTP_Request} HTTP/%{NUMBER:Http_Version}" %{NUMBER:Http_Status_Code} (?:%{NUMBER:Http_Bytes}|-) (?:"(?:%{URI:Http_Referrer}|-)"|%{QS:Http_Referrer}) %{QS:User_Agent} "(%{QS:X_Forwarded_For}|-)" "(%{IPORHOST:Site}|-)" "(%{NUMBER:Request_Time}|-)" "(%{NUMBER:Upstream_Response_Time}|-)" (%{WORD:Device}|-) (%{USERNAME:App_Version}|-) (%{HOSTNAME:Upstream_Host}:%{POSINT:Upstram_Port}|-) (%{WORD:Openudid}|-) (%{WORD:Usercode}|-) (%{WORD:NetType}|-) "(%{GREEDYDATA:Device_Name}|-)" "(%{GREEDYDATA:System_Verion}|-)"