{"id":1670,"date":"2023-03-25T22:23:02","date_gmt":"2023-03-25T14:23:02","guid":{"rendered":"https:\/\/www.appblog.cn\/?p=1670"},"modified":"2023-04-23T21:52:22","modified_gmt":"2023-04-23T13:52:22","slug":"logstash-replace-timestamp-with-logging-time","status":"publish","type":"post","link":"https:\/\/www.appblog.cn\/index.php\/2023\/03\/25\/logstash-replace-timestamp-with-logging-time\/","title":{"rendered":"Logstash\u4f7f\u7528\u65e5\u5fd7\u8bb0\u5f55\u65f6\u95f4\u66ff\u6362@timestamp"},"content":{"rendered":"<p>Logstash\u5728\u5904\u7406\u6570\u636e\u7684\u65f6\u5019\uff0c\u4f1a\u81ea\u52a8\u751f\u6210\u4e00\u4e2a\u5b57\u6bb5<code>@timestamp<\/code>\uff0c\u9ed8\u8ba4\u8be5\u5b57\u6bb5\u5b58\u50a8\u7684\u662fLogstash\u6536\u5230\u6d88\u606f\/\u4e8b\u4ef6(event)\u7684\u65f6\u95f4\u3002<\/p>\n<p>date\u63d2\u4ef6\uff1a\u65e5\u671f\u8fc7\u6ee4\u5668\u7528\u4e8e\u4ece\u5b57\u6bb5\u4e2d\u89e3\u6790\u65e5\u671f\uff0c\u7136\u540e\u4f7f\u7528\u8be5\u65e5\u671f\u6216\u65f6\u95f4\u6233\u4f5c\u4e3a\u4e8b\u4ef6\u7684logstash\u65f6\u95f4\u6233\u3002<\/p>\n<p><!-- more --><\/p>\n<pre><code>filter {\n    if [message] =~ &quot;^\\d{4}-\\d{2}-\\d{2}\\s\\d{2}:\\d{2}:\\d{2}.\\d{3}\\s+\\[[a-zA-Z0-9._-]+\\]\\s*\\[\\s*[a-zA-Z0-9._-]+\\s*\\][\\s\\S]*$&quot; {\n        grok {\n            ...\n        }\n        date {\n            match =&gt; [&quot;logtime&quot;, &quot;yyyy-MM-dd HH:mm:ss.SSS&quot;] \n            #target =&gt; &quot;messagetime&quot;\n            #locale =&gt; &quot;en&quot;\n            #timezone =&gt; &quot;+00:00&quot;\n            remove_field =&gt; [&quot;logtime&quot;]\n        }\n    }\n}<\/code><\/pre>\n<pre><code>nohup bin\/logstash -f config.conf &gt;\/dev\/null &amp;<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Logstash\u5728\u5904\u7406\u6570\u636e\u7684\u65f6\u5019\uff0c\u4f1a\u81ea\u52a8\u751f\u6210\u4e00\u4e2a\u5b57\u6bb5@timestamp\uff0c\u9ed8\u8ba4\u8be5\u5b57\u6bb5\u5b58\u50a8\u7684\u662fLogstash\u6536 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[345],"tags":[343],"class_list":["post-1670","post","type-post","status-publish","format-standard","hentry","category-elk","tag-logstash"],"_links":{"self":[{"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/posts\/1670","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/comments?post=1670"}],"version-history":[{"count":0,"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/posts\/1670\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/media?parent=1670"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/categories?post=1670"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appblog.cn\/index.php\/wp-json\/wp\/v2\/tags?post=1670"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}