Logstash 中的日期过滤器因 dateparsefailure 而失败
Date filter in Logstash is failing with dateparsefailure
我有以下 logstash 输出。我想用 Timestamp 字段的值更新 @timestamp 字段(并最终从输出中删除 Timestamp 字段)。我正在使用日期过滤器,但它不起作用。下面是配置。我无法理解我在这里缺少什么
Sample output
{
"@version" => "1",
"Timestamp" => "2020-07-25T22:06:09.1282069+05:30",
"Level" => "Information",
"headers" => {
"content_type" => "application/json; charset=utf-8",
"http_user_agent" => nil,
"request_path" => "/",
"http_host" => "localhost:8081",
"http_accept" => nil,
"request_method" => "POST",
"content_length" => "253",
"http_version" => "HTTP/1.1"
},
"tags" => [
[0] "_dateparsefailure"
],
"ExecutionId" => "4e1a5929-e52c-4aee-ae64-41f8750885ab",
"@timestamp" => 2020-07-25T16:36:09.474Z,
"RenderedMessage" => "This is Stream message with guid 4e1a5929-e52c-4aee-ae64-41f8750885ab",
"host" => "127.0.0.1",
"MessageTemplate" => "This is Stream message with guid 4e1a5929-e52c-4aee-ae64-41f8750885ab"
}
日期过滤器
filter {
date {
match => [ "Timestamp", "YYYY-MM-dd HH:mm:ss" ]
}
}
我能够通过使用 ISO8601 格式解决这个问题
filter {
date {
match => [ "Timestamp", "ISO8601" ]
}
}
我有以下 logstash 输出。我想用 Timestamp 字段的值更新 @timestamp 字段(并最终从输出中删除 Timestamp 字段)。我正在使用日期过滤器,但它不起作用。下面是配置。我无法理解我在这里缺少什么
Sample output
{
"@version" => "1",
"Timestamp" => "2020-07-25T22:06:09.1282069+05:30",
"Level" => "Information",
"headers" => {
"content_type" => "application/json; charset=utf-8",
"http_user_agent" => nil,
"request_path" => "/",
"http_host" => "localhost:8081",
"http_accept" => nil,
"request_method" => "POST",
"content_length" => "253",
"http_version" => "HTTP/1.1"
},
"tags" => [
[0] "_dateparsefailure"
],
"ExecutionId" => "4e1a5929-e52c-4aee-ae64-41f8750885ab",
"@timestamp" => 2020-07-25T16:36:09.474Z,
"RenderedMessage" => "This is Stream message with guid 4e1a5929-e52c-4aee-ae64-41f8750885ab",
"host" => "127.0.0.1",
"MessageTemplate" => "This is Stream message with guid 4e1a5929-e52c-4aee-ae64-41f8750885ab"
}
日期过滤器
filter {
date {
match => [ "Timestamp", "YYYY-MM-dd HH:mm:ss" ]
}
}
我能够通过使用 ISO8601 格式解决这个问题
filter {
date {
match => [ "Timestamp", "ISO8601" ]
}
}