zoukankan      html  css  js  c++  java
  • kibana上传日志时间与日志里面的时间不同

    中间加了一层转换,日志从filebeat采集进入logstash,然后将日志中的时间字段覆盖到es的@timestamp字段,kibana会将这个字段当做是日志的上传时间

    input {
      beats {
        port => 10515
      }
    }
    
    filter{
      if "xxx" in [tags]{
        grok {
            match => ["message","%{TIMESTAMP_ISO8601:log.date}"]
        }
        date {
            match => ["log.date", "yyyy-MM-dd HH:mm:ss,SSS"]
            target => "@timestamp"
        }
      }
      if "xxx" in [tags]{
        grok {
            match => ["message","%{TIMESTAMP_ISO8601:timestamp8601}"]
        }
        date {
            match => ["timestamp8601", "yyyy-MM-dd HH:mm:ss.SSS"]
            target => "@timestamp"
        }
      }
      if "xxx" in [tags]{
        grok {
            match => ["message","%{TIMESTAMP_ISO8601:timestamp8601}"]
        }
        date {
            match => ["timestamp8601", "yyyy-MM-dd HH:mm:ss.SSS"]
            target => "@timestamp"
        }
      }
    
    }
    
    output {
      if "xxx" in [tags]{
         elasticsearch {
           hosts => ["http://xxx:9200"]
           #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
           index => "xxx-%{+YYYY.MM}"
           user => "xxx"
           password => "xxx"
         }
      }
    
      if "xxx" in [tags]{
         elasticsearch {
           hosts => ["http://xxx:9200"]
           #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
           index => "xxx-%{+YYYY.MM}"
           user => "xxx"
           password => "xxx"
         }
      }
      if "xxx" in [tags]{
         elasticsearch {
           hosts => ["http://xxx:9200"]
           #index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
           index => "xxx-%{+YYYY.MM}"
           user => "xxx"
           password => "xxx"
         }
      }
    
    }
    

      

  • 相关阅读:
    c#常用的技巧
    在Web应用程序中使用Castle ActiveRecord
    Castle Query返回System.String程序报错的解决方法
    C++标准转换运算符const_cast
    Linux目录解释
    [转载]存储过程与函数的区别
    详解GCC的下载和安装
    Linux控制台的快捷键
    Linux下软件的安装和卸载
    电路交换,报文交换和分组交换
  • 原文地址:https://www.cnblogs.com/bill2014/p/15040986.html
Copyright © 2011-2022 走看看