Logstash过滤器可转换"$ epoch.$ microsec"到"$ epoch_millis" [英] Logstash filter to convert "$epoch.$microsec" to "$epoch_millis"

问题描述

我正在尝试将格式为$epoch.$microsec的时间戳字段转换为$epoch_millis.

I am trying to convert a timestamp field that is in the form $epoch.$microsec to $epoch_millis.

示例:

1415311569.541062  -->  1415311569541

Logstash似乎没有任何可乘数的方法，因此ts * 1000并将其强制转换为long都是可行的.

Logstash doesn't appear to have any means of multiplying numbers so ts * 1000 and casting to a long is out.

有什么想法吗?

推荐答案

在您的特定情况下，您确实可以将问题变成字符串处理问题，但是您也可以使用ruby过滤器:

In your particular case you can indeed get away with turning the problem into a string manipulation problem, but you can also use the ruby filter:

filter {
  ruby {
    # do some calculation
    code => "event['ts'] = (1000 * event['ts'].to_f).round"
  }
}

这篇关于Logstash过滤器可转换"$ epoch.$ microsec"到"$ epoch_millis"的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！