log_format log_json '{"@timestamp":"$time_iso8601",'
                           '"http_host":"$http_host",'
                           '"clientip":"$remote_addr",'
                           '"request":"$request",'
                           '"status":"$status",'
                           '"size":"$body_bytes_sent",'
                           '"upstream_addr":"$upstream_addr",'
                           '"upstream_status":"$upstream_status",'
                           '"upstream_response_time":"$upstream_response_time",'
                           '"request_time":"$request_time",'
                           '"http_referer":"$http_referer",'
                           '"http_user_agent":"$http_user_agent",'
                           '"http_x_forwarded_for":"$http_x_forwarded_for"}';

input {
  file {
    path => "/www/wwwlogs/*access"
    start_position => "end"
    exclude => "*.gz"
    type => "access_log"
  }
  file {
    path => "/www/wwwlogs/*error"
    start_position => "end"
    exclude => "*.gz"
    type => "error_log"
  }

}

filter {
   json {
        source => "message"
   }
   grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
   }
   geoip {
        source => "clientip"
        database =>"/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.12-java/vendor/GeoLite2-City.mmdb"
        add_field => ["[geoip][coordinates]","%{[geoip][longitude]}"] # 获取经度
        add_field => ["[geoip][coordinates]","%{[geoip][latitude]}"] # 获取纬度
        fields => ["country_name","region_name","location"]
   }
   mutate {
        convert => ["[geoip][coordinates]","float"] # 修改经纬度为浮点数
   }
}

output {
  #stdout {
  #  codec => rubydebug
  #}
  if "access_log" in [type] {
     elasticsearch {
         hosts => ["10.128.0.116:9200"]
         index => "logstash-nginx-access-%{+YYYY.MM.dd}"
     }
  }
  if "error_log" in [type] {
     elasticsearch {
         hosts => ["10.128.0.116:9200"]
         index => "logstash-nginx-error-%{+YYYY.MM.dd}"
     }
  }
}