zoukankan      html  css  js  c++  java
  • kibana上传日志时间与日志里面的时间不同

    中间加了一层转换,日志从filebeat采集进入logstash,然后将日志中的时间字段覆盖到es的@timestamp字段,kibana会将这个字段当做是日志的上传时间

    input {
      beats {
        port => 10515
      }
    }
    
    filter{
      if "xxx" in [tags]{
        grok {
            match => ["message","%{TIMESTAMP_ISO8601:log.date}"]
        }
        date {
            match => ["log.date", "yyyy-MM-dd HH:mm:ss,SSS"]
            target => "@timestamp"
        }
      }
      if "xxx" in [tags]{
        grok {
            match => ["message","%{TIMESTAMP_ISO8601:timestamp8601}"]
        }
        date {
            match => ["timestamp8601", "yyyy-MM-dd HH:mm:ss.SSS"]
            target => "@timestamp"
        }
      }
      if "xxx" in [tags]{
        grok {
            match => ["message","%{TIMESTAMP_ISO8601:timestamp8601}"]
        }
        date {
            match => ["timestamp8601", "yyyy-MM-dd HH:mm:ss.SSS"]
            target => "@timestamp"
        }
      }
    
    }
    
    output {
      if "xxx" in [tags]{
         elasticsearch {
           hosts => ["http://xxx:9200"]
           #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
           index => "xxx-%{+YYYY.MM}"
           user => "xxx"
           password => "xxx"
         }
      }
    
      if "xxx" in [tags]{
         elasticsearch {
           hosts => ["http://xxx:9200"]
           #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
           index => "xxx-%{+YYYY.MM}"
           user => "xxx"
           password => "xxx"
         }
      }
      if "xxx" in [tags]{
         elasticsearch {
           hosts => ["http://xxx:9200"]
           #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
           index => "xxx-%{+YYYY.MM}"
           user => "xxx"
           password => "xxx"
         }
      }
    
    }
    

      

  • 相关阅读:
    Nginx负载均衡配置实例详解
    网络性能排查
    tensorflow、cuda、cudnn之间的版本对应关系
    PyPI可以使用的几个国内源
    Ceres配置(vs2013+Win10)
    vs2013+opencv3.2配置
    Ceres Solver 在win8+vs2013环境下的安装
    51Nod-1006 最长公共子序列Lcs
    Qt中OpenGL模块下将图片转化为纹理,并传入shader中
    harris角点检测
  • 原文地址:https://www.cnblogs.com/bill2014/p/15040986.html
Copyright © 2011-2022 走看看