只需将其放入一个名为
grok.conf：
input { file { path => "/path/to/your/file.log" start_position => beginning sincedb_path => "/dev/null" }}filter { grok { match => {"message" => "%{WORD:username} %{WORD:email} %{WORD:hash}" } }}output { elasticsearch { hosts => ["localhost:9200"] }}然后使用运行Logstash，
bin/logstash -f grok.conf您应该可以。
