elasticsearch - 将消息中的日期替换为Logstash中的@timestamp

Question

我有此日志http://wklej.org/id/2777228/，我希望此日志中的日期成为时间戳。我的配置文件:

http://wklej.org/id/2777231/

但是这还行。 http://wklej.org/id/2777230/

Answer 1

这是我尝试过的，对我有用:

filter {
    grok{
         match => {"message" => "%{TIMESTAMP_ISO8601:myTimestamp}"}
        }
    date {
            locale => "en"
            match => ["myTimestamp", "YYYY-MM-dd HH:mm:ss,SSS", "ISO8601"]
            timezone => "Europe/Warsaw"
            add_field => { "debug" => "timestampMatched"}
        }
}

输出:

  "_source": {
    "message": "2016-08-03 10:19:44,503 [DEBUG] NHibernate.SQL: SELECT this_.ID as ID6_0_, this_.Valor as Valor6_0_, this_.ANALYTIC_DATA_ID as ANALYTIC3",
    "@version": "1",
    "@timestamp": "2016-08-03T08:19:44.503Z",
    "host": "RST-Mrunal",
    "myTimestamp": "2016-08-03 10:19:44,503",
    "debug": "timestampMatched"
  }

希望能帮助到你!