用Logstash中的@timestamp替換來自消息的日期

Question

我有這個日誌http://wklej.org/id/2777228/，我希望從這個日誌的日期成爲時間戳。我的配置文件：

http://wklej.org/id/2777231/

但THID ONT工作。 http://wklej.org/id/2777230/

Answer 1

這是我嘗試過和它的工作對我來說：

filter { 
    grok{ 
     match => {"message" => "%{TIMESTAMP_ISO8601:myTimestamp}"} 
     } 
    date { 
      locale => "en" 
      match => ["myTimestamp", "YYYY-MM-dd HH:mm:ss,SSS", "ISO8601"] 
      timezone => "Europe/Warsaw" 
      add_field => { "debug" => "timestampMatched"} 
     } 
} 

輸出：

"_source": { 
    "message": "2016-08-03 10:19:44,503 [DEBUG] NHibernate.SQL: SELECT this_.ID as ID6_0_, this_.Valor as Valor6_0_, this_.ANALYTIC_DATA_ID as ANALYTIC3", 
    "@version": "1", 
    "@timestamp": "2016-08-03T08:19:44.503Z", 
    "host": "RST-Mrunal", 
    "myTimestamp": "2016-08-03 10:19:44,503", 
    "debug": "timestampMatched" 
    } 

希望它能幫助！