Logstash配置文件处理日志时间

Posted 2020-11-29 yangjiming

将SpringBoot生成的日志文件，通过Logstash传输到Elasticsearch。日志文件内容格式如下

2019-11-12 22:01:23.358 调用==>用户退出登录接口参数=>"{"phone":"17010058888","token":"oo:8da500acb09d7e3ef2e9e61dcc6b5908"}"

编写logstash.conf文件，内容如下，将日志打印的时间戳转换为timestamp类型

input {
    file {
        type => "auth_log"
        path => ["/logs/auth.log"]
        start_position => "beginning"
        sincedb_path => "/dev/null"
    }
}

filter {
        grok {
          match => { "message" => "s*%{TIMESTAMP_ISO8601:time}s*%{NOTSPACE:rest}" }
        }
        date {
          match => ["time", "yyyy-MM-dd HH:mm:ss.SSS"]
          target => "@timestamp"
        }
        mutate {
          remove_field =>["message"]
        }
}
output {
  elasticsearch {
    hosts => "ip:9200"
    index => "logstash-%{+YYYY.MM.dd}"
  }
}