我想将“logdate”类型记录为日期,但是即使在应用日期过滤器后,我也将“logdate”类型记录为字符串。这是我的过滤器:
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:logdate}\s%{LOGLEVEL:level} +: +%{WORD:USE_CASE} +: +%{WORD:STEP_DETAIL} +: +\[%{WORD:CIN}\] +: +(?<MID>([^\s]+)) +: +%{GREEDYDATA:MESSAGE_DETAILS}" }
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
add_tag => [ "level:%{level}" ]
add_tag => [ "USE_CASE:%{USE_CASE}" ]
add_tag => [ "CIN:%{CIN}" ]
add_tag => [ "MID-%{MID}" ]
}
date {
match => [ "logdate", "yyyy-MM-dd HH:mm:ss,SSS" ]
target => "@timestamp"
}
}
这是我点击命令后得到的映射
curl -XGET localhost:9200/_mapping?pretty
映射:
"logdate" : {
"type" : "string",
"norms" : {
"enabled" : false
},
"fields" : {
"raw" : {
"type" : "string",
"index" : "not_analyzed",
"ignore_above" : 256
}
}
},
我在哪里做错了?有什么建议吗?
最佳答案
如果希望logdate
字段为日期字段,则需要使其成为target
过滤器的date
date {
match => [ "logdate", "yyyy-MM-dd HH:mm:ss,SSS" ]
target => "logdate"
}
这不会将
@timestamp
设置为同一件事,因此您可能需要再次设置@timestamp
。关于elasticsearch - Logstash logdate类型问题,我们在Stack Overflow上找到一个类似的问题:https://stackoverflow.com/questions/30025018/