Logstash的date插件
在Logstash中，date 过滤器插件用于解析事件中的日期和时间字段，并将其转换为Logstash可以理解和索引的日期格式。这对于将日志文件中的时间戳转换为统一的日期格式特别有用，尤其是在将日志数据发送到Elasticsearch等搜索引擎时。
date插件的主要参数
date过滤器插件的主要参数包括：
locale: 参数允许你指定一个特定的区域设置，以便Logstash能够正确理解和解析这些日期字符串，与timezone配合使用。该字段的值应该写你当前的地区，查看地区选择,下面附录是同步过来的match：指定要解析的日期字段和可能的日期格式。这是一个数组，其中每个元素都是一个包含两个元素的数组，第一个元素是字段名，第二个元素是该字段可能的日期格式。Logstash会尝试使用提供的格式来解析字段中的日期。target：指定将解析后的日期存储在哪个字段中。如果不指定，则默认更新@timestamp字段。timezone：指定解析日期时要使用的时区。如果不指定，则使用系统默认时区。查看时区也可以查询下面附录
案例
假设你需要转化一个 23/Oct/2024:14:07:57 +0800 格式的日期到elasticsearch并作为@timestamp使用
filter {
date {
# 指定地区（必须指定地区）
locale => "zh-CN"
# 指定要解析的字段和格式
match => [ "logdate", "dd/MMM/yyyy:HH:mm:ss Z" ]
# 可选：指定转换后的日期存储在哪个字段（默认为@timestamp）
# target => "@timestamp"
# 指定时区（如果日志中的时间不是UTC，并且没有时区信息）
timezone => "Asia/Shanghai"
}
}
在这个例子中：
match参数指定了要解析的字段名（logdate）和预期的日期格式（dd/MMM/yyyy:HH:mm:ss Z）。这里的格式应该与你的日志中实际的时间戳格式相匹配。
target参数是可选的，用于指定转换后的日期应该存储在哪个字段中。如果不指定，则默认更新 @timestamp 字段。
timezone用于指定解析日期时要使用的时区。如果日志中的时间已经是UTC或者包含了时区信息（如Z表示UTC，+0800表示UTC+8），则可能不需要指定这个参数。
locale用于指定当前地区，是配合timezone一起转化日期，这两个不能分开使用。
附录
locale 参数值：
| 语言标签 | 语言 | 地区 | 描述 |
|---|---|---|---|
| ar-SA | Arabic | Saudi Arabia | Arabic (Saudi Arabia) |
| bn-BD | Bangla | Bangladesh | Bangla (Bangladesh) |
| bn-IN | Bangla | India | Bangla (India) |
| cs-CZ | Czech | Czech Republic | Czech (Czech Republic) |
| da-DK | Danish | Denmark | Danish (Denmark) |
| de-AT | German | Austria | Austrian German |
| de-CH | German | Switzerland | “Swiss” German |
| de-DE | German | Germany | Standard German (as spoken in Germany) |
| el-GR | Greek | Greece | Modern Greek |
| en-AU | English | Australia | Australian English |
| en-CA | English | Canada | Canadian English |
| en-GB | English | United Kingdom | British English |
| en-IE | English | Ireland | Irish English |
| en-IN | English | India | Indian English |
| en-NZ | English | New Zealand | New Zealand English |
| en-US | English | United States | US English |
| en-ZA | English | South Africa | English (South Africa) |
| es-AR | Spanish | Argentina | Argentine Spanish |
| es-CL | Spanish | Chile | Chilean Spanish |
| es-CO | Spanish | Columbia | Colombian Spanish |
| es-ES | Spanish | Spain | Castilian Spanish (as spoken in Central-Northern Spain) |
| es-MX | Spanish | Mexico | Mexican Spanish |
| es-US | Spanish | United | States American Spanish |
| fi-FI | Finnish | Finland | Finnish (Finland) |
| fr-BE | French | Belgium | Belgian French |
| fr-CA | French | Canada | Canadian French |
| fr-CH | French | Switzerland | “Swiss” French |
| fr-FR | French | France | Standard French (especially in France) |
| he-IL | Hebrew | Israel | Hebrew (Israel) |
| hi-IN | Hindi | India | Hindi (India) |
| hu-HU | Hungarian | Hungary | Hungarian (Hungary) |
| id-ID | Indonesian | Indonesia | Indonesian (Indonesia) |
| it-CH | Italian | Switzerland | “Swiss” Italian |
| it-IT | Italian | Italy Standard | Italian (as spoken in Italy) |
| ja-JP | Japanese | Japan | Japanese (Japan) |
| ko-KR | Korean | Republic of Korea | Korean (Republic of Korea) |
| nl-BE | Dutch | Belgium | Belgian Dutch |
| nl-NL | Dutch | The Netherlands | Standard Dutch (as spoken in The Netherlands) |
| no-NO | Norwegian | Norway | Norwegian (Norway) |
| pl-PL | Polish | Poland | Polish (Poland) |
| pt-BR | Portugese | Brazil | Brazilian Portuguese |
| pt-PT | Portugese | Portugal | European Portuguese (as written and spoken in Portugal) |
| ro-RO | Romanian | Romania | Romanian (Romania) |
| ru-RU | Russian | Russian Federation | Russian (Russian Federation) |
| sk-SK | Slovak | Slovakia | Slovak (Slovakia) |
| sv-SE | Swedish | Sweden | Swedish (Sweden) |
| ta-IN | Tamil | India | Indian Tamil |
| ta-LK | Tamil | Sri Lanka | Sri Lankan Tamil |
| th-TH | Thai | Thailand | Thai (Thailand) |
| tr-TR | Turkish | Turkey | Turkish (Turkey) |
| zh-CN | Chinese | China | Mainland China, simplified characters |
| zh-HK | Chinese | Hond Kong | Hong Kong, traditional characters |
| zh-TW | Chinese | Taiwan | Taiwan, traditional characters |
timezone参数值：
| Standard Offset | Canonical |
|---|---|
| -12:00 | Etc/GMT+12 |
| -12:00 | Etc/GMT+12 |
| -11:00 | Etc/GMT+11 |
| -11:00 | Pacific/Apia |
| -11:00 | Pacific/Midway |
| -11:00 | Pacific/Niue |
| -11:00 | Pacific/Pago_Pago |
| -10:00 | America/Adak |
| -10:00 | Etc/GMT+10 |
| -10:00 | HST |
| -10:00 | Pacific/Fakaofo |
| -10:00 | Pacific/Honolulu |
| -10:00 | Pacific/Johnston |
| -10:00 | Pacific/Rarotonga |
| -10:00 | Pacific/Tahiti |
| -09:30 | Pacific/Marquesas |
| -09:00 | America/Anchorage |
| -09:00 | America/Juneau |
| -09:00 | America/Nome |
| -09:00 | America/Yakutat |
| -09:00 | Etc/GMT+9 |
| -09:00 | Pacific/Gambier |
| -08:00 | America/Dawson |
| -08:00 | America/Los_Angeles |
| -08:00 | America/Santa_Isabel |
| -08:00 | America/Tijuana |
| -08:00 | America/Vancouver |
| -08:00 | America/Whitehorse |
| -08:00 | Etc/GMT+8 |
| -08:00 | PST8PDT |
| -08:00 | Pacific/Pitcairn |
| -07:00 | America/Boise |
| -07:00 | America/Cambridge_Bay |
| -07:00 | America/Chihuahua |
| -07:00 | America/Dawson_Creek |
| -07:00 | America/Denver |
| -07:00 | America/Edmonton |
| -07:00 | America/Hermosillo |
| -07:00 | America/Inuvik |
| -07:00 | America/Mazatlan |
| -07:00 | America/Ojinaga |
| -07:00 | America/Phoenix |
| -07:00 | America/Yellowknife |
| -07:00 | Etc/GMT+7 |
| -07:00 | MST |
| -07:00 | MST7MDT |
| -06:00 | America/Bahia_Banderas |
| -06:00 | America/Belize |
| -06:00 | America/Cancun |
| -06:00 | America/Chicago |
| -06:00 | America/Costa_Rica |
| -06:00 | America/El_Salvador |
| -06:00 | America/Guatemala |
| -06:00 | America/Indiana/Knox |
| -06:00 | America/Indiana/Tell_City |
| -06:00 | America/Managua |
| -06:00 | America/Matamoros |
| -06:00 | America/Menominee |
| -06:00 | America/Merida |
| -06:00 | America/Mexico_City |
| -06:00 | America/Monterrey |
| -06:00 | America/North_Dakota/Center |
| -06:00 | America/North_Dakota/New_Salem |
| -06:00 | America/Rainy_River |
| -06:00 | America/Rankin_Inlet |
| -06:00 | America/Regina |
| -06:00 | America/Swift_Current |
| -06:00 | America/Tegucigalpa |
| -06:00 | America/Winnipeg |
| -06:00 | CST6CDT |
| -06:00 | Etc/GMT+6 |
| -06:00 | Pacific/Easter |
| -06:00 | Pacific/Galapagos |
| -05:00 | America/Atikokan |
| -05:00 | America/Bogota |
| -05:00 | America/Cayman |
| -05:00 | America/Detroit US/Michigan |
| -05:00 | America/Grand_Turk |
| -05:00 | America/Guayaquil |
| -05:00 | America/Havana |
| -05:00 | America/Indiana/Indianapolis |
| -05:00 | America/Indiana/Marengo |
| -05:00 | America/Indiana/Petersburg |
| -05:00 | America/Indiana/Vevay |
| -05:00 | America/Indiana/Vincennes |
| -05:00 | America/Indiana/Winamac |
| -05:00 | America/Iqaluit |
| -05:00 | America/Jamaica |
| -05:00 | America/Kentucky/Louisville |
| -05:00 | America/Kentucky/Monticello |
| -05:00 | America/Lima |
| -05:00 | America/Montreal |
| -05:00 | America/Nassau |
| -05:00 | America/New_York |
| -05:00 | America/Nipigon |
| -05:00 | America/Panama |
| -05:00 | America/Pangnirtung |
| -05:00 | America/Port-au-Prince |
| -05:00 | America/Resolute |
| -05:00 | America/Thunder_Bay |
| -05:00 | America/Toronto Canada/Eastern |
| -05:00 | EST |
| -05:00 | EST5EDT |
| -05:00 | Etc/GMT+5 |
| -04:30 | America/Caracas |
| -04:00 | America/Anguilla |
| -04:00 | America/Antigua |
| -03:00 | America/Argentina/San_Luis |
| -04:00 | America/Aruba |
| -04:00 | America/Asuncion |
| -04:00 | America/Barbados |
| -04:00 | America/Blanc-Sablon |
| -04:00 | America/Boa_Vista |
| -04:00 | America/Campo_Grande |
| -04:00 | America/Cuiaba |
| -04:00 | America/Curacao |
| -04:00 | America/Dominica |
| -04:00 | America/Eirunepe |
| -04:00 | America/Glace_Bay |
| -04:00 | America/Goose_Bay |
| -04:00 | America/Grenada |
| -04:00 | America/Guadeloupe |
| -04:00 | America/Guyana |
| -04:00 | America/Halifax |
| -04:00 | America/La_Paz |
| -04:00 | America/Manaus |
| -04:00 | America/Martinique |
| -04:00 | America/Moncton |
| -04:00 | America/Montserrat |
| -04:00 | America/Port_of_Spain |
| -04:00 | America/Porto_Velho |
| -04:00 | America/Puerto_Rico |
| -04:00 | America/Rio_Branco |
| -04:00 | America/Santiago |
| -04:00 | America/Santo_Domingo |
| -04:00 | America/St_Kitts |
| -04:00 | America/St_Lucia |
| -04:00 | America/St_Thomas |
| -04:00 | America/St_Vincent |
| -04:00 | America/Thule |
| -04:00 | America/Tortola |
| -04:00 | Antarctica/Palmer |
| -04:00 | Atlantic/Bermuda |
| -04:00 | Atlantic/Stanley |
| -04:00 | Etc/GMT+4 |
| -03:30 | America/St_Johns |
| -03:00 | America/Araguaina |
| -03:00 | America/Argentina/Buenos_Aires |
| -03:00 | America/Argentina/Catamarca |
| -03:00 | America/Argentina/Cordoba |
| -03:00 | America/Argentina/Jujuy |
| -03:00 | America/Argentina/La_Rioja |
| -03:00 | America/Argentina/Mendoza |
| -03:00 | America/Argentina/Rio_Gallegos |
| -03:00 | America/Argentina/Salta |
| -03:00 | America/Argentina/San_Juan |
| -03:00 | America/Argentina/Tucuman |
| -03:00 | America/Argentina/Ushuaia |
| -03:00 | America/Bahia |
| -03:00 | America/Belem |
| -03:00 | America/Cayenne |
| -03:00 | America/Fortaleza |
| -03:00 | America/Godthab |
| -03:00 | America/Maceio |
| -03:00 | America/Miquelon |
| -03:00 | America/Montevideo |
| -03:00 | America/Paramaribo |
| -03:00 | America/Recife |
| -03:00 | America/Santarem |
| -03:00 | America/Sao_Paulo |
| -03:00 | Antarctica/Rothera |
| -03:00 | Etc/GMT+3 |
| -02:00 | America/Noronha |
| -02:00 | Atlantic/South_Georgia |
| -02:00 | Etc/GMT+2 |
| -01:00 | America/Scoresbysund |
| -01:00 | Atlantic/Azores |
| -01:00 | Atlantic/Cape_Verde |
| -01:00 | Etc/GMT+1 |
| +00:00 | Africa/Abidjan |
| +00:00 | Africa/Accra |
| +00:00 | Africa/Bamako |
| +00:00 | Africa/Banjul |
| +00:00 | Africa/Bissau |
| +00:00 | Africa/Casablanca |
| +00:00 | Africa/Conakry |
| +00:00 | Africa/Dakar |
| +00:00 | Africa/El_Aaiun |
| +00:00 | Africa/Freetown |
| +00:00 | Africa/Lome |
| +00:00 | Africa/Monrovia |
| +00:00 | Africa/Nouakchott |
| +00:00 | Africa/Ouagadougou |
| +00:00 | Africa/Sao_Tome |
| +00:00 | America/Danmarkshavn |
| +00:00 | Atlantic/Canary |
| +00:00 | Atlantic/Faroe |
| +00:00 | Atlantic/Madeira |
| +00:00 | Atlantic/Reykjavik |
| +00:00 | Atlantic/St_Helena |
| +00:00 | Etc/GMT |
| +00:00 | Etc/UCT |
| +00:00 | Etc/UTC |
| +00:00 | Europe/Dublin |
| +00:00 | Europe/Lisbon |
| +00:00 | Europe/London |
| +00:00 | UTC |
| +00:00 | WET |
| +01:00 | Africa/Algiers |
| +01:00 | Africa/Bangui |
| +01:00 | Africa/Brazzaville |
| +01:00 | Africa/Ceuta |
| +01:00 | Africa/Douala |
| +01:00 | Africa/Kinshasa |
| +01:00 | Africa/Lagos |
| +01:00 | Africa/Libreville |
| +01:00 | Africa/Luanda |
| +01:00 | Africa/Malabo |
| +01:00 | Africa/Ndjamena |
| +01:00 | Africa/Niamey |
| +01:00 | Africa/Porto-Novo |
| +01:00 | Africa/Tunis |
| +01:00 | Africa/Windhoek |
| +01:00 | CET |
| +01:00 | Etc/GMT-1 |
| +01:00 | Europe/Amsterdam |
| +01:00 | Europe/Andorra |
| +01:00 | Europe/Belgrade |
| +01:00 | Europe/Berlin |
| +01:00 | Europe/Brussels |
| +01:00 | Europe/Budapest |
| +01:00 | Europe/Copenhagen |
| +01:00 | Europe/Gibraltar |
| +01:00 | Europe/Luxembourg |
| +01:00 | Europe/Madrid |
| +01:00 | Europe/Malta |
| +01:00 | Europe/Monaco |
| +01:00 | Europe/Oslo |
| +01:00 | Europe/Paris |
| +01:00 | Europe/Prague |
| +01:00 | Europe/Rome |
| +01:00 | Europe/Stockholm |
| +01:00 | Europe/Tirane |
| +01:00 | Europe/Vaduz |
| +01:00 | Europe/Vienna |
| +01:00 | Europe/Warsaw |
| +01:00 | Europe/Zurich |
| +01:00 | MET |
| +02:00 | Africa/Blantyre |
| +02:00 | Africa/Bujumbura |
| +02:00 | Africa/Cairo |
| +02:00 | Africa/Gaborone |
| +02:00 | Africa/Harare |
| +02:00 | Africa/Johannesburg |
| +02:00 | Africa/Kigali |
| +02:00 | Africa/Lubumbashi |
| +02:00 | Africa/Lusaka |
| +02:00 | Africa/Maputo |
| +02:00 | Africa/Maseru |
| +02:00 | Africa/Mbabane |
| +02:00 | Africa/Tripoli |
| +02:00 | Asia/Amman |
| +02:00 | Asia/Beirut |
| +02:00 | Asia/Damascus |
| +02:00 | Asia/Gaza |
| +02:00 | Asia/Jerusalem |
| +02:00 | Asia/Nicosia |
| +02:00 | EET |
| +02:00 | Etc/GMT-2 |
| +02:00 | Europe/Athens |
| +02:00 | Europe/Bucharest |
| +02:00 | Europe/Chisinau |
| +02:00 | Europe/Helsinki |
| +02:00 | Europe/Istanbul |
| +02:00 | Europe/Kaliningrad |
| +02:00 | Europe/Kiev |
| +02:00 | Europe/Minsk |
| +02:00 | Europe/Riga |
| +02:00 | Europe/Simferopol |
| +02:00 | Europe/Sofia |
| +02:00 | Europe/Tallinn |
| +02:00 | Europe/Uzhgorod |
| +02:00 | Europe/Vilnius |
| +02:00 | Europe/Zaporozhye |
| +03:00 | Africa/Addis_Ababa |
| +03:00 | Africa/Asmara |
| +03:00 | Africa/Dar_es_Salaam |
| +03:00 | Africa/Djibouti |
| +03:00 | Africa/Kampala |
| +03:00 | Africa/Khartoum |
| +03:00 | Africa/Mogadishu |
| +03:00 | Africa/Nairobi |
| +03:00 | Antarctica/Syowa |
| +03:00 | Asia/Aden |
| +03:00 | Asia/Baghdad |
| +03:00 | Asia/Bahrain |
| +03:00 | Asia/Kuwait |
| +03:00 | Asia/Qatar |
| +03:00 | Asia/Riyadh |
| +03:00 | Etc/GMT-3 |
| +03:00 | Europe/Moscow |
| +03:00 | Europe/Samara |
| +03:00 | Europe/Volgograd |
| +03:00 | Indian/Antananarivo |
| +03:00 | Indian/Comoro |
| +03:00 | Indian/Mayotte |
| +03:30 | Asia/Tehran Iran |
| +04:00 | Asia/Baku |
| +04:00 | Asia/Dubai |
| +04:00 | Asia/Muscat |
| +04:00 | Asia/Tbilisi |
| +04:00 | Asia/Yerevan |
| +04:00 | Etc/GMT-4 |
| +04:00 | Indian/Mahe |
| +04:00 | Indian/Mauritius |
| +04:00 | Indian/Reunion |
| +04:30 | Asia/Kabul |
| +05:00 | Antarctica/Mawson |
| +05:00 | Asia/Aqtau |
| +05:00 | Asia/Aqtobe |
| +05:00 | Asia/Ashgabat |
| +05:00 | Asia/Dushanbe |
| +05:00 | Asia/Karachi |
| +05:00 | Asia/Oral |
| +05:00 | Asia/Samarkand |
| +05:00 | Asia/Tashkent |
| +05:00 | Asia/Yekaterinburg |
| +05:00 | Etc/GMT-5 |
| +05:00 | Indian/Kerguelen |
| +05:00 | Indian/Maldives |
| +05:30 | Asia/Colombo |
| +05:30 | Asia/Kolkata |
| +05:45 | Asia/Kathmandu |
| +06:00 | Antarctica/Vostok |
| +06:00 | Asia/Almaty |
| +06:00 | Asia/Bishkek |
| +06:00 | Asia/Dhaka |
| +06:00 | Asia/Novokuznetsk |
| +06:00 | Asia/Novosibirsk |
| +06:00 | Asia/Omsk |
| +06:00 | Asia/Qyzylorda |
| +06:00 | Asia/Thimphu |
| +06:00 | Etc/GMT-6 |
| +06:00 | Indian/Chagos |
| +06:30 | Asia/Rangoon |
| +06:30 | Indian/Cocos |
| +07:00 | Antarctica/Davis |
| +07:00 | Asia/Bangkok |
| +07:00 | Asia/Ho_Chi_Minh |
| +07:00 | Asia/Hovd |
| +07:00 | Asia/Jakarta |
| +07:00 | Asia/Krasnoyarsk |
| +07:00 | Asia/Phnom_Penh |
| +07:00 | Asia/Pontianak |
| +07:00 | Asia/Vientiane |
| +07:00 | Etc/GMT-7 |
| +07:00 | Indian/Christmas |
| +08:00 | Antarctica/Casey |
| +08:00 | Asia/Brunei |
| +08:00 | Asia/Choibalsan |
| +08:00 | Asia/Chongqing |
| +08:00 | Asia/Harbin |
| +08:00 | Asia/Hong_Kong |
| +08:00 | Asia/Irkutsk |
| +08:00 | Asia/Kashgar |
| +08:00 | Asia/Kuala_Lumpur |
| +08:00 | Asia/Kuching |
| +08:00 | Asia/Macau |
| +08:00 | Asia/Makassar |
| +08:00 | Asia/Manila |
| +08:00 | Asia/Shanghai |
| +08:00 | Asia/Singapore |
| +08:00 | Asia/Taipei ROC |
| +08:00 | Asia/Ulaanbaatar |
| +08:00 | Asia/Urumqi |
| +08:00 | Australia/Perth |
| +08:00 | Etc/GMT-8 |
| +08:45 | Australia/Eucla |
| +09:00 | Asia/Dili |
| +09:00 | Asia/Jayapura |
| +09:00 | Asia/Pyongyang |
| +09:00 | Asia/Seoul ROK |
| +09:00 | Asia/Tokyo Japan |
| +09:00 | Asia/Yakutsk |
| +09:00 | Etc/GMT-9 |
| +09:00 | Pacific/Palau |
| +09:30 | Australia/Adelaide |
| +09:30 | Australia/Broken_Hill |
| +09:30 | Australia/Darwin |
| +10:00 | Antarctica/DumontDUrville |
| +10:00 | Asia/Sakhalin |
| +10:00 | Asia/Vladivostok |
| +10:00 | Australia/Brisbane |
| +10:00 | Australia/Currie |
| +10:00 | Australia/Hobart |
| +10:00 | Australia/Lindeman |
| +10:00 | Australia/Melbourne |
| +10:00 | Australia/Sydney |
| +10:00 | Etc/GMT-10 |
| +10:00 | Pacific/Chuuk |
| +10:00 | Pacific/Guam |
| +10:00 | Pacific/Port_Moresby |
| +10:00 | Pacific/Saipan |
| +10:30 | Australia/Lord_Howe |
| +11:00 | Antarctica/Macquarie |
| +11:00 | Asia/Anadyr |
| +11:00 | Asia/Kamchatka |
| +11:00 | Asia/Magadan |
| +11:00 | Etc/GMT-11 |
| +11:00 | Pacific/Efate |
| +11:00 | Pacific/Guadalcanal |
| +11:00 | Pacific/Kosrae |
| +11:00 | Pacific/Noumea |
| +11:00 | Pacific/Pohnpei |
| +11:30 | Pacific/Norfolk |
| +12:00 | Antarctica/McMurdo |
| +12:00 | Etc/GMT-12 |
| +12:00 | Pacific/Auckland |
| +12:00 | Pacific/Fiji |
| +12:00 | Pacific/Funafuti |
| +12:00 | Pacific/Kwajalein |
| +12:00 | Pacific/Majuro |
| +12:00 | Pacific/Nauru |
| +12:00 | Pacific/Tarawa |
| +12:00 | Pacific/Wake |
| +12:00 | Pacific/Wallis |
| +12:45 | Pacific/Chatham |
| +13:00 | Etc/GMT-13 |
| +13:00 | Pacific/Enderbury |
| +13:00 | Pacific/Tongatapu |
| +14:00 | Etc/GMT-14 |
| +14:00 | Pacific/Kiritimati |
扫一扫
226
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
