Date Logstash-自定义时间戳错误
我试图在Logstash中输入一个timestamp字段,并得到dateparsefailure消息 我的信息- 2014-08-01;11:00:22.123 管道文件Date Logstash-自定义时间戳错误,date,timestamp,logstash,logstash-grok,Date,Timestamp,Logstash,Logstash Grok,我试图在Logstash中输入一个timestamp字段,并得到dateparsefailure消息 我的信息- 2014-08-01;11:00:22.123 管道文件 input { stdin{} #beats { # port => "5043" # } } # optional. filter { date { locale => "en" match => ["message", "YYYY-MM-dd;HH:
input {
stdin{}
#beats {
# port => "5043"
# }
}
# optional.
filter {
date {
locale => "en"
match => ["message", "YYYY-MM-dd;HH:mm:ss.SSS"]
target => "@timestamp"
add_field => { "debug" => "timestampMatched"}
}
}
output {
elasticsearch {
hosts => [ "127.0.0.1:9200" ]
}
stdout { codec => rubydebug }
}
有人能告诉我我错过了什么吗
更新1
我提到了这个链接,现在它起作用了
但是,在我的日志消息中,除了timestamp之外,我还有多个值
<B 2014-08-01;11:00:22.123 Field1=Value1 Field2=Value2
我在下面贴出答案和我用来解决这个问题的步骤,这样我就能帮助像我这样的人 步骤1-我以键和值对的形式读取消息 步骤2-我删除了导致解析异常的额外空间 步骤3-我读取时间戳值和各个字段中的其他字段
input {
beats {
port => "5043"
}
}
# optional.
filter {
kv { }
date {
match => [ "timestamp", "yyyy-MM-dd HH:mm:ss,SSS" ]
remove_field => [ "timestamp" ]
}
}
output {
elasticsearch {
hosts => [ "127.0.0.1:9200" ]
}
}
input {
beats {
port => "5043"
}
}
# optional.
filter {
kv { }
date {
match => [ "timestamp", "yyyy-MM-dd HH:mm:ss,SSS" ]
remove_field => [ "timestamp" ]
}
}
output {
elasticsearch {
hosts => [ "127.0.0.1:9200" ]
}
}