LogStash存数据进ES，使用日志时间而非插入时间

input {
  
  beats {
    port => 4567
    # codec => "json"
    # codec=>plain{charset=>"UTF-8"}
  }
}

filter {
  json {
    source => "message"
    remove_field => ["message","@version","path","beat","input","log","offset","prospector","source","tags"]
  }
  # 主要是下面这个配置，timestamp是日志传过来的时间，@timestamp是默认的插入ES的时间，kinaba默认就是用的@timestamp来排序的
  # 日志数据如下：{"@timestamp":"2021-01-14T02:37:51.579Z","message":"hello world! currentTime:2021-01-14 10:37:51"}
  date {
        match => ["timestamp", "dd/MMM/yyyy:HH:mm:ss Z"]
        target => "@timestamp"
    }
}

output {
   # stdout { codec => plain{charset=>"UTF-8"}}
   stdout { codec => rubydebug }
   elasticsearch {
     hosts => "http://127.0.0.1:9200"
     index => "log_test"
   }
}