处理器名称： spring-logback-proc

PUT _ingest/pipeline/spring-logback-proc
{
  "description": "process spring logback log key filed to index",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": [
          "%{TIMESTAMP_ISO8601:logtime}%{SPACE}\\[%{WORD:trace.id}\\]%{SPACE}\\[%{DATA:thread_name}\\]%{SPACE}%{LOGLEVEL:log.level}%{SPACE}%{DATA:log.logger}%{SPACE}\\-%{SPACE}",
          "%{TIMESTAMP_ISO8601:logtime}%{SPACE}\\[%{DATA:thread_name}\\]%{SPACE}%{LOGLEVEL:log.level}%{SPACE}%{DATA:log.logger}%{SPACE}\\-%{SPACE}"
        ],
        "ignore_missing": true
      }
    },
    {
      "date": {
        "field": "logtime",
        "formats": [
          "yyyy-MM-dd HH:mm:ss.SSS"
        ],
        "timezone": "Asia/Shanghai"
      }
    }
  ]
}

对应的Logback 日志格式

%d{yyyy-MM-dd HH:mm:ss.SSS} [%X{traceId}] [%thread] %-5level %logger{50} - %msg%n