使用redis做缓存情况下，logstash配置文件示例

cat >/etc/logstash/config/redis.conf << 'EOF'
input {
  redis {
    host => "localhost"
    port => "6379"
    db => "0"
    key => "ng_access"
    data_type => "list"
  }
    redis {
    host => "localhost"
    port => "6379"
    db => "0"
    key => "ng_error"
    data_type => "list"
  }
}

filter {
  mutate {
    convert => ["upstream_time", "float"]
    convert => ["request_time", "float"]
  }
}

output {
    stdout {}
# 输出，这的tags就是在filebeat那边新增的自定义字段名
    if "access" in [tags] {
        elasticsearch {
          hosts => "http://192.168.53.21:9200"
          manage_template => false
          index => "nginx_access-%{+yyyy}"
        }
    }
    if "error" in [tags] {
        elasticsearch {
          hosts => "http://192.168.53.21:9200"
          manage_template => false
          index => "nginx_error-%{+yyyy}"
        }
    }    
}
EOF