# -*- encoding:utf-8 -*-

import time
from chinesename import ChineseName

cn = ChineseName()

while True:
    now = time.strftime("%Y-%m-%d %H:%M:%S", time.localtime())
    message = "{} {}\n".format(now, cn.getName())
    print(message)

    with open("demo.log", "a", encoding="utf-8") as f:
        f.write(message)

    # 每3秒生成一条日志     
    time.sleep(3)

2019-06-13 18:01:31 容休

filebeat.prospectors:

./filebeat -e -c filebeat.yml -d "publish"

%{SYNTAX:SEMANTIC}

(?<name>pattern)

$ mkdir ./patterns
$ cat ./patterns/datetime.re
DATETIME \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}

input {
    beats {
        port => "5044"
    }
}
filter {
    grok {
        patterns_dir => ["./patterns"]
        match => { 
            "message" => "%{DATETIME:logdate} (?<text>(.*))"
        }
        remove_field  => "message"
   }
   date {
        match => ["logdate", "yyyy-MM-dd HH:mm:ss"]
    }
}
output {
    stdout { codec => rubydebug }
    elasticsearch {
        hosts => [ "localhost:9200" ]
    }
}

# 解析配置文件并报告任何错误
$ ./bin/logstash -f es-pipeline.conf --config.test_and_exit

# 启用自动配置加载
$ ./bin/logstash -f es-pipeline.conf --config.reload.automatic

$ elasticsearch
$ kibana