logstash 将两个字段合并为一个字段的方法

假设message中含有[01/14/2020][18:35:46]，想要把这两个拼接为一个日期字段，需要使用mutate插件：

grok{
    match => {
        "message" => "\[%{GREEDYDATA:yearmonthday}\]\[%{GREEDYDATA:time}\]"
    }
}
mutate{
    add_field => {"timestamp" => "%{yearmonthday} %{time}"}
}
date{
    match => ["timestamp", "MM/dd/yyyy HH:mm:ss"]
    target => "@timestamp"
    remove_field => ["timestamp","yearmonthday","time"]
}

这样到es中就会只剩下@timestamp这一个含有年月日时分秒的字段。