logstash date插件介紹

時間處理(Date)

以前章節已經提過，

filters/date 插件能夠用來轉換你的日誌記錄中的時間字符串，變成 LogStash::Timestamp 對象，而後轉存到 @timestamp 字段裏

output {
      if   [type] == "zj_frontend_access"{ 
        elasticsearch {
                hosts => "192.168.32.80:9200"
                index => "logstash-zjzc-frontend-%{+YYYY.MM.dd}"
        }
		stdout {
			codec => rubydebug
		}
      }  
      else if  [type] == "wj_frontend_access"{
      elasticsearch {
                hosts => "192.168.32.81:9200"
                index => "logstash-wj-frontend-%{+YYYY.MM.dd}"
        }
                stdout {
                        codec => rubydebug
                } 
  
  }

}


注意：由於在稍後的 outputs/elasticsearch 中經常使用的 %{+YYYY.MM.dd} 這種寫法必須讀取 @timestamp 數據，

因此必定不要直接刪掉這個字段保留本身的字段，而是應該用 filters/date 轉換後刪除本身的字段！

[elk@zjtest7-frontend config]$ ../bin/logstash -f stdin02.conf 
Settings: Default pipeline workers: 1
Pipeline main started
12/Sep/2016:21:32:33 +0800
{
       "message" => "12/Sep/2016:21:32:33 +0800",
      "@version" => "1",
    "@timestamp" => "2016-09-13T02:00:19.890Z",
          "host" => "0.0.0.0",
       "logdate" => "12/Sep/2016:21:32:33 +0800"
}

[elk@zjtest7-frontend config]$ cat stdin02.conf 
input {
    stdin {
    }
}

filter {
    grok {
        match => ["message", "%{HTTPDATE:logdate}"]
    }
#    date {
#        match => ["logdate", "dd/MMM/yyyy:HH:mm:ss Z"]
#        add_field =>["response_time","%{logdate}"]
#    }
}
output {
 stdout {
  codec=>rubydebug{}
   }
 }
 
 使用date插件:
 [elk@zjtest7-frontend config]$ cat stdin02.conf 
input {
    stdin {
    }
}

filter {
    grok {
        match => ["message", "%{HTTPDATE:logdate}"]
    }
    date {
        match => ["logdate", "dd/MMM/yyyy:HH:mm:ss Z"]
        add_field =>["response_time","%{logdate}"]
    }
}
output {
 stdout {
  codec=>rubydebug{}
   }
 }

[elk@zjtest7-frontend config]$ ../bin/logstash -f stdin02.conf 
Settings: Default pipeline workers: 1
Pipeline main started
12/Sep/2016:21:32:33 +0800
{
          "message" => "12/Sep/2016:21:32:33 +0800",
         "@version" => "1",
       "@timestamp" => "2016-09-12T13:32:33.000Z",
             "host" => "0.0.0.0",
          "logdate" => "12/Sep/2016:21:32:33 +0800",
    "response_time" => "12/Sep/2016:21:32:33 +0800"
}