logstash时间问题

logstash时间问题

创建索引时间不对问题

参考:https://www.cnblogs.com/zzb666/p/14148898.html

output不用默认nginx-8070-%{+YYYY.MM.dd}时间格式 自定义格式
ruby{
   code => "event.set('index_date', (event.get('@timestamp').time.localtime).strftime('%Y.%m.%d'))"
}

output {
    elasticsearch {
                  hosts => ["172.16.12.88:9200"]
                  #索引解决创建索引时 时区不对的问题
                  index => "nginx-8070-%{index_date}"
                  #index => "nginx-8070-%{+YYYY.MM.dd}"
                  #类型
         codec => plain

          }

}

@timestamp时间问题

# 自定义时间
 ruby { 
   code => "event.set('timestamp', event.get('@timestamp').time.localtime + 8*60*60)" 
 }
 ruby {
   code => "event.set('@timestamp',event.get('timestamp'))"
 }
    mutate {
        remove_field => ["timestamp"]
        convert => ["request_time", "float"]
    }
}

完整的配置

input {
  beats {
    port => 5044
    #设置编码
    codec => plain
     #当存在多个文件的时候可使用type指定输入输出路径
    }
}

#2.过滤格式化数据阶段

filter {
    grok {
        match => {
            "message" => "%{IP:remote_addr} - (%{WORD:remote_user}|-) \[%{HTTPDATE:time_local}\] \"%{WORD:method} /%{WORD}/%{WORD:dep}/%{WORD:res}%{NOTSPACE:request} HTTP/%{NUMBER:version}\" %{NUMBER:status} %{NUMBER:body_bytes_sent} %{QS} %{QS:http_user_agent} %{QS} \"%{NUMBER:request_time}\" \"%{NUMBER:connection}\" %{QS} %{QS:host}%{QS:request_body}"
        }
    }
    date {
        match => ["time_local", "dd/MMM/yyyy:HH:mm:ss Z"]
        target => "@timestamp"
     }
ruby{
   code => "event.set('index_date', (event.get('@timestamp').time.localtime).strftime('%Y.%m.%d'))"
}

 ruby { 
   code => "event.set('timestamp', event.get('@timestamp').time.localtime + 8*60*60)" 
 }
 ruby {
   code => "event.set('@timestamp',event.get('timestamp'))"
 }
    mutate {
        remove_field => ["timestamp"]
        convert => ["request_time", "float"]
    }
}
#3.数据输出到ES阶段
output {
    elasticsearch {
                  hosts => ["172.16.12.88:9200"]
                  #索引解决创建索引时 时区不对的问题
                  index => "nginx-8070-%{index_date}"
                  #index => "nginx-8070-%{+YYYY.MM.dd}"
                  #类型
         codec => plain

          }

}

评论

  1. 3周前
    2023-5-04 12:50:53

    Dead pent written content, Really enjoyed studying. Gavin Wery

发送评论 编辑评论


				
|´・ω・)ノ
ヾ(≧∇≦*)ゝ
(☆ω☆)
(╯‵□′)╯︵┴─┴
 ̄﹃ ̄
(/ω\)
∠( ᐛ 」∠)_
(๑•̀ㅁ•́ฅ)
→_→
୧(๑•̀⌄•́๑)૭
٩(ˊᗜˋ*)و
(ノ°ο°)ノ
(´இ皿இ`)
⌇●﹏●⌇
(ฅ´ω`ฅ)
(╯°A°)╯︵○○○
φ( ̄∇ ̄o)
ヾ(´・ ・`。)ノ"
( ง ᵒ̌皿ᵒ̌)ง⁼³₌₃
(ó﹏ò。)
Σ(っ °Д °;)っ
( ,,´・ω・)ノ"(´っω・`。)
╮(╯▽╰)╭
o(*////▽////*)q
>﹏<
( ๑´•ω•) "(ㆆᴗㆆ)
😂
😀
😅
😊
🙂
🙃
😌
😍
😘
😜
😝
😏
😒
🙄
😳
😡
😔
😫
😱
😭
💩
👻
🙌
🖕
👍
👫
👬
👭
🌚
🌝
🙈
💊
😶
🙏
🍦
🍉
😣
Source: github.com/k4yt3x/flowerhd
颜文字
Emoji
小恐龙
花!
上一篇
下一篇