0

我想通过logstash的日期过滤插件过滤twitter的推文,"@timestamps": "2016-08-10T06:46:26.031Z"如果有人帮助我,这是我现在想根据现在的日期和时间过滤的每条推文的字段?

她是我的logstash配置

input {
twitter {
consumer_key => "key"
consumer_secret => "consumer key"
oauth_token => "aut"
oauth_token_secret => "oauth token"
keywords => [ "afghanistan", "TOLOnews", "kabul", "police"]
full_tweet => true
}
}

filter {
  date {
      match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
  }
}
output {
   stdout { codec => dots }
    elasticsearch {
        hosts => "10.20.1.168"

        index => "twitter-%+YYYY.MM.DD"
        document_type => "tweets"
    }
}

但这不起作用,因为它索引了大多数推文

4

0 回答 0