我已经尝试了几个小时,但 grok 根本不想正确解析时间戳:
信息:
Tue, 13 Oct 2015 21:30:26 GMT users_service Three users logged in.
.conf 文件:
input { stdin { } }
filter {
grok {
match => { "message" => "%{DAY:day}, %{MONTHDAY:month_day} %{MONTH:month} %{YEAR:year} %{TIME:time} GMT %{WORD:service} %{GREEDYDATA:message_entry}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
date {
match => [ "timestamp", "dd MMM yyyy HH:mm:ss" ]
locale => "en"
}
}
output {
elasticsearch { host => localhost }
stdout { codec => rubydebug }
}
我得到的是:
{
"message" => "Tue, 13 Oct 2015 21:30:26 GMT users_service Three users logged in.",
"@version" => "1",
"@timestamp" => "2015-10-13T23:09:58.738Z",
"host" => "users_host",
"day" => "Tue",
"month_day" => "13",
"month" => "Oct",
"year" => "2015",
"time" => "21:30:26",
"service" => "users_service",
"message_entry" => "Three users logged in.",
"received_at" => "2015-10-13T23:09:58.738Z",
"received_from" => "users_host"
}
我原以为那里有一块timestamp
田地,但没有。