WarpParse 快得难以想象 又如此轻量简洁

rule nginx { (
    json | take(log) | json_unescape() | (
        ip:sip,
        2*_,
        time:recv_time<[,]>,
        http/request",
        http/status,
        digit,
        chars",
        http/agent",
        _"
    )
) }

obj = parse_json!(string!(.message))
. = object!(obj)

.|= parse_regex!(
  string!(.log),
  r'^(?P<sip>\S+)\s+\S+\s+\S+\s+\[(?P<recv_time>\d{2}\/[A-Za-z]{3}\/\d{4}:\d{2}:\d{2}:\d{2})\s+[+\-]\d{4}\]\s+"(?P<http_request>[^"]*)"\s+(?P<status>\d{3})\s+(?P<digit>\d+)\s+"(?P<chars>[^"]*)"\s+"(?P<http_agent>[^"]*)"\s+"[^"]*"\s*$'
)
.status = to_int!(.status)
.digit = to_int!(.digit)
del(.log)
del(.message)

filter {
  json {
    source => "message"
  }

  dissect {
    mapping => {
      "log" => '%{sip} - - [%{recv_time} %{+recv_time}] "%{http_request}" %{status} %{digit} "%{chars}" "%{http_agent}" "%{ignore_tail}"'
    }
    tag_on_failure => ["nginx_dissect_failure"]
  }

  mutate {
    convert => {
      "status" => "integer"
      "digit"  => "integer"
    }
  }

  mutate {
    remove_field => ["log", "message", "ignore_tail","@timestamp","@version","event"]
  }
}