解决logstash导入数据时区问题(差8小时)

config文件同级节点中加入以下内容：

# 解决elk系统使用utc时区带来的八小时问题
filter {
    ruby { 
        code => "event.set('timestamp', event.get('@timestamp').time.utc+8*60*60)" 
    } 
    mutate { 
        convert => ["timestamp", "string"] 
        gsub => ["timestamp", "T([\S\s]*?)Z", ""] 
        gsub => ["timestamp", "-", "."] 
    }
}

若索引字段中有日期字段，则需要在导入数据时也做矫正，以sqlserver为例:

SELECT DATEADD(hour,8, createDate) as createDate from...