在logstash中解析日期字段到弹性搜索 [英] Parsing a date field in logstash to elastic search

问题描述

我正在尝试从IIS中解析日志文件到ELK堆栈（Logstash：2.3，Elastic：2.3和Kibana：4.5，CentOS 7 vm）尝试使用日志过滤器在日志记录配置中从日志消息中解析日志字段作为事件时间戳记：

  date {
 match => [date_timestamp，yyyy-MM-dd HH：mm：ss] 
 timezone => 欧洲/伦敦
 locale => en
 target => @timestamp
} 
  

已解析的整个日志消息的前几个字符弹性搜索是：

 message：2016-03-01 03:30:49 ...... ... 
  

上述日期字段已解析为弹性搜索：

 date_timestamp：16-03-01 03:30:49，
  

但是，使用上述日期过滤器解析为弹性搜索的事件时间戳是：

 @ timestamp：0016-03-01T03：32：04.000Z，
  

我会喜欢@timestamp完全是GMT3-01T03：30：49，因为我不能立即弄清楚为什么时间和分钟之间有区别。

我已经看过类似的问题和文档，例如这一个在SO上，而这一个在 logstash文档和 logstash文档

任何指向正确方向的指针将不胜感激。

注意

SO

解决方案

在您的 date_timestamp 中只有2个字符年： 16 -03-01 03:30:49，所以您日期过滤器中的日期格式不正确，应为：

  date {
 match => [date_timestamp，yy-MM-dd HH：mm：ss] 
 timezone => 欧洲/伦敦
 locale => en
 target => @timestamp
} 
  

I am trying to parse log files from IIS to the ELK stack (Logstash:2.3, Elastic:2.3 and Kibana:4.5, CentOS 7 vm).

I have attempted to parse a date field from the log message as the event timestamp using the date filter below in my logstash configuration:

date {
    match => ["date_timestamp", "yyyy-MM-dd HH:mm:ss"]
    timezone => "Europe/London"
    locale => "en"
    target => "@timestamp"
} 

The first few characters of the entire log message that was parsed to Elastic Search is:

"message": "2016-03-01 03:30:49  .........

The date field above was parsed to Elastic Search as:

"date_timestamp": "16-03-01 03:30:49",

However, the event timestamp that was parsed to Elastic Search using the date filter above is:

"@timestamp": "0016-03-01T03:32:04.000Z",

I will like the @timestamp to be exactly 2016-03-01T03:30:49 as I can't immediately figure out why there is a difference between the hours and minutes.

I have looked at similar problems and documentations such as this one on SO and this one on logstash documentation and logstash documentation.

Any pointer in the right direction will be appreciated.

Regards

SO

解决方案

in your date_timestamp you have only 2 characters for year: "16-03-01 03:30:49", so the date pattern in your date filter is incorrect, should be:

date {
    match => ["date_timestamp", "yy-MM-dd HH:mm:ss"]
    timezone => "Europe/London"
    locale => "en"
    target => "@timestamp"
} 

这篇关于在logstash中解析日期字段到弹性搜索的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！