eg：
日志
100.2.215.21 cnweb-01 [25/Sep/2018:03:45:03 +0800] "GET /test.html HTTP/1.1" "www.test.cn" 200 521 "0.000" "-" "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)" "100.28.246.114"
规则
%{IP:ip} %{NOTSPACE:name} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion}))" \"%{HOSTNAME:hostname}\" %{NUMBER:status} %{NUMBER:bytes} %{NOTSPACE:s} %{NOTSPACE:s1} %{NOTSPACE:s2} %{QS:ua} \"%{NOTSPACE:true_ip}\"
参考
https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns
https://grokdebug.herokuapp.com/