简体   繁体   English

Logstash 中的日期过滤器因 dateparsefailure 而失败

[英]Date filter in Logstash is failing with dateparsefailure

I have following logstash output.我有以下logstash output。 I want to update @timestamp field with value of Timestamp field (and eventually remove Timestamp field from the output).我想用 Timestamp 字段的值更新@timestamp 字段(并最终从输出中删除 Timestamp 字段)。 I am using date filter but it is not working.我正在使用日期过滤器,但它不起作用。 Below is configuration.下面是配置。 I am not able to understand what I am missing here我无法理解我在这里缺少什么

Sample output

{
       "@version" => "1",
      "Timestamp" => "2020-07-25T22:06:09.1282069+05:30",
          "Level" => "Information",
        "headers" => {
       "content_type" => "application/json; charset=utf-8",
    "http_user_agent" => nil,
       "request_path" => "/",
          "http_host" => "localhost:8081",
        "http_accept" => nil,
     "request_method" => "POST",
     "content_length" => "253",
       "http_version" => "HTTP/1.1"
},
           "tags" => [
    [0] "_dateparsefailure"
],
    "ExecutionId" => "4e1a5929-e52c-4aee-ae64-41f8750885ab",
     "@timestamp" => 2020-07-25T16:36:09.474Z,
"RenderedMessage" => "This is Stream message with guid 4e1a5929-e52c-4aee-ae64-41f8750885ab",
           "host" => "127.0.0.1",
"MessageTemplate" => "This is Stream message with guid 4e1a5929-e52c-4aee-ae64-41f8750885ab"

} }

Date filter日期过滤器

filter {
    date {
        match => [ "Timestamp", "YYYY-MM-dd HH:mm:ss" ]
      }
}

I was able to fix this issue by using ISO8601 format我能够通过使用 ISO8601 格式解决此问题

filter {
    date {
        match => [ "Timestamp", "ISO8601" ]
      }
}

声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM