logstash处理@timestamp时区

最新推荐文章于 2023-11-22 10:28:47 发布

L-960

最新推荐文章于 2023-11-22 10:28:47 发布

阅读量2.4k

点赞数 1

分类专栏： elk 文章标签： ruby

本文链接：https://blog.csdn.net/weixin_43702146/article/details/120180217

版权

elk 专栏收录该内容

28 篇文章 2 订阅

订阅专栏

input { stdin { } }
filter {
#ruby {
#    code => "event.set('timestamp', event.get('@timestamp') + 8*60*60)" 
#    code => "event.set('aaa', event.get('@timestamp').time.localtime)"
#    code => "event.set('bbb', event.timestamp.time.localtime + 8*60*60)"
#    code => "event.set('ccc', event.timestamp.time.localtime.strftime('%Y-%m-%d'))"
#    code => "event.set('eee', event.timestamp.time.localtime.strftime('%Y-%m-%d %H:%M:%S'))"
#}
#ruby { 
#    code => "event.set('timestamp', (event.get('@timestamp').time.localtime + 8*60*60).strftime('%Y.%m.%d'))"    
#}

#ruby { code => "event.set('bbb', event.timestamp.time.localtime + 8*60*60)" }
#ruby { code => "event.set('ccc', event.timestamp.time.localtime.strftime('%Y-%m-%d'))" }
#ruby { code => "event.set('eee', event.timestamp.time.localtime.strftime('%Y-%m-%d %H:%M:%S'))" }

ruby { 
code => "event.set('timestamp', event.get('@timestamp').time.localtime + 8*60*60)" 
}

ruby{
code => "event.set('day', (event.get('@timestamp').time.localtime + 8*60*60).strftime('%Y.%m.%d'))"
}
}
output {
stdout { codec=> rubydebug }
}

ruby {#设置一个自定义字段'timestamp'[这个字段可自定义]，将logstash自动生成的时间戳中的值加8小时，赋给这个字段
                code => "event.set('timestamp', event.get('@timestamp').time.localtime + 8*3600)"
        }
        ruby {#将自定义时间字段中的值重新赋给@timestamp
                code => "event.set('@timestamp',event.get('timestamp'))"
        }
        mutate {#删除自定义字段
                remove_field => ["timestamp"]
        }

ruby {#设置一个自定义字段’timestamp’[这个字段可自定义]，将logstash自动生成的时间戳中的值加8小时，赋给这个字段
code => “event.set(‘timestamp’, event.get(’@timestamp’).time.localtime + 8*3600)”
}
ruby {#将自定义时间字段中的值重新赋给@timestamp
code => “event.set(’@timestamp’,event.get(‘timestamp’))”
}
mutate {#删除自定义字段
remove_field => [“timestamp”]
}