logstash.conf

input {
	beats {
		port => 5044
	}

	tcp {
		port => 5000
	}
}

## Add your filters / logstash plugins configuration here

filter {
	ruby {
		path => "/usr/share/logstash/pipeline/ruby_scripts/filter.rb"
	}
}

output {
	elasticsearch {
		hosts => "elasticsearch:9200"
		user => elastic
		password => changeme
	}
}

filter.rb

def filter(event)
  message = event.get("message")

  #I, [2019-05-30T16:28:15.190600 #23883]  INFO -- : [0a2c622a-38ca-4efc-9e33-c3a0da69d5fa] Started GET "/admin/programs/1/style_edit" for 139.226.75.36 at 2019-05-30 16:28:15 +0800
  headline = message.match(/(Started.*)/).to_s.split

  if headline.size > 0
    event.set("Rails.verb", headline[1])
    event.set("Rails.path", headline[2])
    event.set("Rails.remote_ip", headline[4])
    event.set("Rails.timestamp",
              Time.parse(headline[-3..-1].join("\s"))#.utc.iso8601
    )
  end

  #I, [2019-05-30T16:28:15.192503 #23883]  INFO -- : [0a2c622a-38ca-4efc-9e33-c3a0da69d5fa] Processing by Admin::ProgramsController#style_edit as HTML
  processing_line = message.match(/(Processing.*)/).to_s.split
  if processing_line.size > 0
    event.set("Rails.controller", processing_line[2]&.split("#")[0])
    event.set("Rails.action", processing_line[2])
    event.set("Rails.render_as", processing_line[-1])
  end

  #I, [2019-05-30T17:14:31.152482 #23970]  INFO -- : [aeffbd66-26bb-4d50-885c-16602ab75c67]   Parameters: {"id"=>"1"}
  parameters_line = message.match(/(Parameters.*)/).to_s.split
  event.set("Rails.parameters", parameters_line[1])


  #I, [2019-05-30T16:51:35.173690 #23970]  INFO -- : [b0b2595a-00a3-469d-ba26-2d5002c52400] Completed 200 OK in 314ms (Views: 174.0ms | ActiveRecord: 127.9ms | Elasticsearch: 0.0ms)
  last_line = message.match(/(Completed.*)/).to_s.split

  if last_line.size > 0
    event.set("Rails.response_status", last_line[1])
    event.set("Rails.during_ms", last_line.select {|s| s =~ /ms/}.first.to_i)
  end


  #F, [2019-05-30T14:14:28.008451 #23970] FATAL -- : [94229ffd-3d67-42c5-8251-75cb1354872f] ActionController::RoutingError (No route matches [GET] "/pos/coupons/https:/i.998.com/Activity/HaoMianReservationDraw"):
  error_line = message.match(/(^F.*?\d{4}-\d{2}-\d{2}T.*?--\s:\s\[[a-z0-9-]{36}\]\s*)(.*?)Error*/).to_s.split
  if error_line.size > 0
    event.set("Rails.error", error_line.last)
    event.set("Rails.has_error", true)
    event.set("Rails.response_status", "500")
  else
    event.set("Rails.has_error", false)
  end

  [event]
end