如何更改logstash中的日期格式

Question

我有如下日志；

04/12/2020 5:12:56 PM
05/12/2020 6:13:36 AM

我想匹配这些字段并在下面更改为这种格式；

2020-12-04 17:12:56
2020-12-04 06:13:36

我如何在 logstash 中执行此操作？

感谢您的回答

Answer 1

此代码给出

filter {
      mutate {
         add_field => {"old_time" => "04/12/2020 5:12:56 PM"}
      }

      ruby {
         code => '
              time = Time.parse(event.get("old_time")).strftime("%y-%m-%d %H:%M:%S")
              event.set("new_time", time)

         '
       }

     mutate {
        remove_field => ["host","@timestamp","sequence","message","@version"]
     } 
 }

这个输出

{
   "old_time" => "04/12/2020 5:12:56 PM",
   "new_time" => "20-12-04 17:12:56"
}

如何更改logstash中的日期格式

How to change date format in logstash

logstash