Logstash匹配日志日期

案例
日志格式：

• | - | 08/Mar/2018:03:31:14 +0800
  匹配配置文件：
  input {
  stdin {
  }
  }
  filter {
  grok {
  match => [
  "message", "%{USER} | %{USER} | %{HTTPDATE:timestamp}"
  ]
  }
  date {
  match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
  locale => "en"
  }
  }
  output {
  stdout {
  codec=>rubydebug{}
  }
  }

参考博文：http://blog.csdn.net/zhaoyangjian724/article/details/52523385

转载于:https://blog.51cto.com/linux10000/2084506