关于logstash正则处理日志格式为json的求教

筷子eason

最近做elk监控服务产生的日志日志的原始输出格式是：

11:00:12:191[INFO]db_send head:length:0
11:00:12:192[INFO][DBP] recv data(len=12):
11:00:12:192[INFO]db_recv head:length:0
11:00:17:224[INFO]db_send head:length:0
11:00:17:224[INFO][DBP] recv data(len=12):
11:00:17:224[INFO]db_recv head:length:0
11:00:22:262[INFO]db_send head:length:0
11:00:22:262[INFO][DBP] recv data(len=12):
11:00:22:262[INFO]db_recv head:length:0
11:00:27:299[INFO]db_send head:length:0
11:00:27:299[INFO][DBP] recv data(len=12):
11:00:27:299[INFO]db_recv head:length:0
11:00:32:336[INFO]db_send head:length:0
11:00:32:336[INFO][DBP] recv data(len=12):
11:00:32:336[INFO]db_recv head:length:0
11:00:37:373[INFO]db_send head:length:0
11:00:37:374[INFO][DBP] recv data(len=12):
11:00:37:374[INFO]db_recv head:length:0
11:00:41:377[DEBU]加载本地配置...
11:00:41:379[DEBU]加载配置完成


因elasticsearch只能读取json格式的日志

能否帮忙写个logstash的grok过滤正则处理日志后的json的格式类似

time: 11:00:37:374level: INFOmessges:db_recv head:length:0