【ELK】logstash通过配置文件对日志时间格式更改

input {
    	file {
	    #ModSecurity审计日志的存放位置，请根据实际情况进行修改
		path => ["/var/log/modsec_audit.log"]
		start_position => "beginning"
	}
}

filter{
	json{
		source => "message"
		remove_field => ["message"]
	}
    #以下到filter节点结束的内容，是为了将ModSecurity记录的日期转换为数据库可存放的datetime格式
	mutate{
		split => ["[transaction][time_stamp]"," "]
		add_field => { "date" => "yyyy-MM-dd HH:mm:ss" }
		add_field => { "month" => "%{[transaction][time_stamp][1]}" }
		add_field => { "day" => "%{[transaction][time_stamp][2]}" }
		add_field => { "time" => "%{[transaction][time_stamp][3]}" }
		add_field => { "year" => "%{[transaction][time_stamp][4]}" }
	}

	if [month] == "Jan" {
		mutate {
			gsub =>["month","Jan",'01']
		}
	} else if [month] == "Feb" {
		mutate {
			gsub =>["month","Feb",'02']
		}
	} else if [month] == "Mar"{
		mutate {
			gsub =>["month","Mar",'03']
		}
	} else if [month] == "Apr"{
		mutate {
			gsub =>["month","Apr",'04']
		}
	} else if [month] == "May"{
		mutate {
			gsub =>["month","May",'05']
		}
	} else if [month] == "Jun"{
		mutate {
			gsub =>["month","Jun",'06']
		}
	} else if [month] == "Jul"{
		mutate {
			gsub =>["month","Jul",'07']
		}
	} else if [month] == "Aug"{
		mutate {
			gsub =>["month","Aug",'08']
		}
	} else if [month] == "Sep"{
		mutate {
			gsub =>["month","Sep",'09']
		}
	} else if [month] == "Oct"{
		mutate {
			gsub =>["month","Oct",'10']
		}
	} else if [month] == "Nov"{
		mutate {
			gsub =>["month","Nov",'11']
		}
	} else if [month] == "Dec"{
		mutate {
			gsub =>["month","Dec",'12']
		}
	}

	mutate {
		gsub =>["date","yyyy",'%{[year]}']
		gsub =>["date","MM",'%{[month]}']
		gsub =>["date","dd",'%{[day]}']
		gsub =>["date","HH:mm:ss",'%{[time]}']
	}
}


output {
    #该节点会将最终日志数据以JSON格式打印到控制台中，便于观测进行调试，测试无问题后可将此节点删除
	stdout {
		codec => json {
			charset => "UTF-8"
		}
	}

     elasticsearch {
         host => "10.27.106.193:9200"
         index => "modsec_audit"
         user => "elastic"
         password => "elastic"
         workers=>5
         template_overwrite =>true
     }
}