Logstash:Unrecognized@timestamp值,将当前时间设置为@timestamp,原始于@timestamp字段
我将json日志消息发送到logstash,如下所示:Logstash:Unrecognized@timestamp值,将当前时间设置为@timestamp,原始于@timestamp字段,logstash,elastic-stack,logstash-configuration,Logstash,Elastic Stack,Logstash Configuration,我将json日志消息发送到logstash,如下所示: {"@timestamp":"2017-08-10 11:32:14.619","level":"DEBUG","logger_name":"application","message":"Request processed in 1 ms"} 和logstash配置有: json { source => "message" } date { match => ["@timestamp", "yyyy-MM-dd
{"@timestamp":"2017-08-10 11:32:14.619","level":"DEBUG","logger_name":"application","message":"Request processed in 1 ms"}
和logstash配置有:
json {
source => "message"
}
date {
match => ["@timestamp", "yyyy-MM-dd HH:mm:ss.SSS"]
timezone => "Europe/Paris"
}
但我在日志中有这样的警告:
[2017-08-10T11:21:16,739][WARN ][logstash.filters.json ] Unrecognized @timestamp value, setting current time to @timestamp, original in _@timestamp field {:value=>"\"2017-08-10 11:20:34.527\""}
我尝试了不同的配置,比如在空格周围添加引号,使用日期过滤器之前的mutate重命名字段(结果显示相同的警告,并且出现一个错误,表示时间戳丢失),等等
在弹性搜索中存储的值中,时间戳是解析日志的时间,而不是原始时间(2/3秒后)
我遗漏了什么?我认为问题在于源消息中的字段名为@timestamp,就像默认值一样 我们通过重命名源代码中的字段解决了此问题,添加并将配置更改为:
date {
match => ["apptimestamp", "yyyy-MM-dd HH:mm:ss.SSS"]
timezone => "Europe/Paris"
}