关于logstash的filter过滤

Question

请问128.241.220.82 - - [21/Dec/2015:11:56:54] "GET /oldlink?itemId=EST-21&JSESSIONID=SD5SL10FF6ADFF2849 HTTP 1.1" 200 2691 "http://www.myflowershop.com/product.screen?productId=RP-LI-02" "Opera/9.01 (Windows NT 5.1; U; en)" 268这条数据怎么用正则表达式提取字段？

目前只写了%{IPORHOST:client} (%{USER:ident}|-) (%{USER:auth}|-)[%{HTTPDATE:timestamp}] 
(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:http_version})?|-)" %{NUMBER:response} %{NUMBER:bytes}

Answer 1

应该是nginx的日志吧,可以设置nginx日志为json格式,logstash可以直接设置codec为json