Logstash:Unrecognized@timestamp值,将当前时间设置为@timestamp,原始于@timestamp字段

Logstash:Unrecognized@timestamp值,将当前时间设置为@timestamp,原始于@timestamp字段,logstash,elastic-stack,logstash-configuration,Logstash,Elastic Stack,Logstash Configuration,我将json日志消息发送到logstash,如下所示: {"@timestamp":"2017-08-10 11:32:14.619","level":"DEBUG","logger_name":"application","message":"Request processed in 1 ms"} 和logstash配置有: json { source => "message" } date { match => ["@timestamp", "yyyy-MM-dd

我将json日志消息发送到logstash,如下所示:

{"@timestamp":"2017-08-10 11:32:14.619","level":"DEBUG","logger_name":"application","message":"Request processed in 1 ms"}
和logstash配置有:

json {
    source => "message"
}

date {
  match => ["@timestamp", "yyyy-MM-dd HH:mm:ss.SSS"]
  timezone => "Europe/Paris"
}
但我在日志中有这样的警告:

[2017-08-10T11:21:16,739][WARN ][logstash.filters.json    ] Unrecognized @timestamp value, setting current time to @timestamp, original in _@timestamp field {:value=>"\"2017-08-10 11:20:34.527\""}
我尝试了不同的配置,比如在空格周围添加引号,使用日期过滤器之前的mutate重命名字段(结果显示相同的警告,并且出现一个错误,表示时间戳丢失),等等

在弹性搜索中存储的值中,时间戳是解析日志的时间,而不是原始时间(2/3秒后)


我遗漏了什么?

我认为问题在于源消息中的字段名为@timestamp,就像默认值一样

我们通过重命名源代码中的字段解决了此问题,添加并将配置更改为:

    date {
  match => ["apptimestamp", "yyyy-MM-dd HH:mm:ss.SSS"]
  timezone => "Europe/Paris"
}