Logstash系列： Date filter plugin日期拦截器的使用

 

指定某个字段作为event的时间戳。

 

id：filter id，便于区分相同date

tag_on_failure：匹配失败输出提示

 

  # 匹配 

#匹配Aug 13 2010 00:03:44

date {
           match => [ "logdate", "MMM dd yyyy HH:mm:ss", "MMM d yyyy HH:mm:ss" ]
          tag_on_failure => ["tag_on_failure_ match"]
       }

}

 

M: 1

MM: 01

MMM：Jan

MMMM：January

d:1

dd:01

 

# 新增使用

date {
          add_field => {
            "foo_%{somefield}" => "Hello world, from %{host}"
            "new_field" => "new_static_value"
          }
 }

 

  # 删除使用

filter {
      date {       
          id => "id_remove_field "
          remove_field => [ "foo_%{somefield}", "my_extraneous_field" ]
       }

       date {
           id => "id_remove_tag "
           remove_tag => [ "foo_%{somefield}", "sad_unwanted_tag"]
       } 
}