在工作中,遇到传过来的是时间字符串yyyy-MM-dd HH:mm:ss,用到logstash时需要先把这种时间转换成long,然后进行存储操作。
上config代码:
input{
stdin{
# codec=>rubydebug
}
}
filter{
# codec=>rubydebug
mutate{
split=>["message"," "]
add_field => {
"field1" => "%{[message][0]}"
}
add_field => {
"field2" => "%{[message][1]}"
}
remove_field => ["message"]
}
ruby{
code=>"
event['field1'] = Time.parse(event['field1']).to_f*1000
"
}
# json{
# source => "field1"
# target => "field1"
# }
}
output{
stdout{
codec=>rubydebug
}
}
event[‘field1’] = Time.parse(event[‘field1’]).to_f*1000 就是这种转换形式。 具体参考ruby吧
http://stackoverflow.com/questions/33490335/logstash-convert-utc-time-to-long-timestamp
http://www.cnblogs.com/wangyuyu/archive/2013/08/03/3235751.html