為了防止一臺機器上多個接入會導致日誌混亂所以地在各模組上新增type標識並作if判斷！

不多比比直接上配置

[root@sf215 conf.d]# cat jddns-servers.conf 
input{
    syslog{
        type => "jddns-servers"
        port => 11514
    }
}
filter {
    if [type] == "jddns-servers" {
        grok {
            match => ["message", "%{DATA:time}, level:%{DATA:level}, domain:%{DATA:domain}, dns_server:%{IP:dns_server}, location:%{DATA:location}, info:%{DATA:info}!"] 
        }
    } 
}        
output {
    if [type] == "jddns-servers" {
        elasticsearch {
            hosts => "ip:9200"
            user => "elastic"
            password => "passwd"
            index => "jddns-servers-%{+yyyy.MM.dd}" 
        }
    }
}
[root@sf215 conf.d]# cat jddns-domains.conf 
input {
    syslog {
        type => "jddns-domains"
        port => 11515
    }
}
filter {
    if [type] == "jddns-domains" {
        grok {
            match => ["message", "%{DATA:time}, level:%{DATA:level}, domain:%{DATA:domain}, dns_server:%{DATA:dns_server}, dueto%{DATA:dueto}, info:%{GREEDYDATA:info}"] 
        }
    } 
}     
output {
    if [type] == "jddns-domains" {
        elasticsearch {
            hosts => "ip:9200"
            user => "elastic"
            password => "passwd"
            index => "jddns-domains-%{+yyyy.MM.dd}" 
        }
    }
}