Grok过滤器在调试器中工作，但在logstash中不工作

Question

我正在尝试将时间标记从源日志文件转换为@timestamp字段，以使其在Kibana中轻松创建仪表板。

尝试使用TIMESTAMP_ISO8601并且还使用单独的日期字段，例如%{MONTHNUM}等。

它不断失败...

filter {
  if "MyApplicationLogfile" in [source] {
    grok {
      match => {"message" => "%{IP:hostip}\s\-\s\-\s%{TIMESTAMP_ISO8601:time}\s%{GREEDYDATA:content}"}
      tag_on_failure => [ "timestampgrokfail" ]
    }
  date {
    match => [ "time", "yyyy-MM-dd HH:mm:ssZZZZ" ]
    target => "@timestamp" }
  }
}

输入为：

10.44.38.25 - - 2019-08-22 14:32:25+0200 "GET /ssm/sso/keepalive HTTP/1.0" 200 12 0 "-" "-" "-"

在Kibana中，它显示标签timestampgrokfail和@timestamp没有填充正确的值吗？

Answer 1

该grok过滤器在7.3.0中为我解析了该消息。 但是，日期过滤器应具有ZZ，而不是ZZZZ

input { generator { count => 1 lines => [ '10.44.38.25 - - 2019-08-22 14:32:25+0200 "GET /ssm/sso/keepalive HTTP/1.0" 200 12 0 "-" "-" "-"' ] } }
filter {
    grok {
        match => {"message" => "%{IP:hostip}\s\-\s\-\s%{TIMESTAMP_ISO8601:time}\s%{GREEDYDATA:content}"}
        tag_on_failure => [ "timestampgrokfail" ]
    }
    date {
        match => [ "time", "yyyy-MM-dd HH:mm:ssZZ" ]
        target => "@timestamp"
    }
}

让我

    "hostip" => "10.44.38.25",
   "content" => "\"GET /ssm/sso/keepalive HTTP/1.0\" 200 12 0 \"-\" \"-\" \"-\"",
      "time" => "2019-08-22 14:32:25+0200",
"@timestamp" => 2019-08-22T12:32:25.000Z,