2016-08-03 30 views

回答

0

這是我嘗試過和它的工作對我來說:

filter { 
    grok{ 
     match => {"message" => "%{TIMESTAMP_ISO8601:myTimestamp}"} 
     } 
    date { 
      locale => "en" 
      match => ["myTimestamp", "YYYY-MM-dd HH:mm:ss,SSS", "ISO8601"] 
      timezone => "Europe/Warsaw" 
      add_field => { "debug" => "timestampMatched"} 
     } 
} 

輸出:

"_source": { 
    "message": "2016-08-03 10:19:44,503 [DEBUG] NHibernate.SQL: SELECT this_.ID as ID6_0_, this_.Valor as Valor6_0_, this_.ANALYTIC_DATA_ID as ANALYTIC3", 
    "@version": "1", 
    "@timestamp": "2016-08-03T08:19:44.503Z", 
    "host": "RST-Mrunal", 
    "myTimestamp": "2016-08-03 10:19:44,503", 
    "debug": "timestampMatched" 
    } 

希望它能幫助!

+0

我發現這個解決方案,但在你和我的情況@timestamp是不同於myTimestamp。我想在以上解決方案中使用timestamp = myTimestamp – crisx

+0

@timestamp = myTimestamp。 –

+0

日期插件的默認目標是'@ timestamp'。 –