filter { if [type] == "elasticsearch" { grok { match => [ "message", ... date { # use timestamp from the log "match" => [ "timestamp", ...
確定! 回上一頁