eg：
日志
127.0.0.1 cnweb-01 [25/Sep/2018:03:45:07 +0800] "GET a.jpg HTTP/1.1" "www.abc.cn" 304 0 "0.000" "-" "http://www.abc.cn/b" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko" "125.71.123.156"
规则
%{IP:ip} %{NOTSPACE:name} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" \"%{HOSTNAME:hostname}\" %{NUMBER:res} %{NUMBER:bytes} %{NOTSPACE:stream} %{NOTSPACE:ss} %{QS:refer} %{QS:ua} %{NOTSPACE:true_ip}