在logstash中替换@timestamp

Question

我的logstasg配置让我疯狂。

我不能找到一种方法，用另一个替换@timestamp领域：

这里是logstash得到：

{ 
          "offset" => 6718968, 
        "Varnish_txid" => "639657758", 
         "plateform" => "cdnfronts", 
         "Referer" => "-", 
         "input_type" => "log", 
         "respsize" => "281", 
          "source" => "/var/log/varnish/varnish4xx-5xx.log", 
           "UA" => "Microsoft-WebDAV-MiniRedir/5.1.2600", 
          "type" => "varnish-logs", 
          "tags" => [ 
     [0] "json", 
     [1] "varnish", 
     [2] "beats_input_codec_json_applied", 
     [3] "_dateparsefailure" 
    ], 
      "st_snt2c_or_sntfromb" => "405", 
         "RemoteHost" => "32.26.21.21", 
         "@timestamp" => 2017-02-14T13:38:47.808Z, 
       "Varnish.Handling" => "pass", 
    "tot_bytes_rcvby_c_or_sntby_b" => "-", 
     "time_req_rcv4c_or_snt4b" => "[14/Feb/2017:14:38:44 +0100]", 
         "@version" => "1", 
          "beat" => { 
     "hostname" => "cdn1", 
      "name" => "cdn1", 
     "version" => "5.1.2" 
    }, 
          "host" => "cdn1", 
        "time_1st_byte" => "0.010954", 
        "Varnish_side" => "c", 
        "reqfirstline" => "OPTIONS http://a.toto.com/ HTTP/1.1" 
} 

这里是我的logstash的conf：

input { 
    beats { 
     port => 5000 
     codec => "json" 
     ssl => true 
     ssl_certificate => "/etc/logstash/ssl/logstash-forwarder.crt" 
     ssl_key => "/etc/logstash/ssl/logstash-forwarder.key" 

    } 
} 
filter { 
    if "json" in [tags] { 
    json { 
     source => "message" 
    } 
    if "varnish" in [tags] { 
    date { 
     locale => "en" 
     match => [ "[time_req_rcv4c_or_snt4b]","dd/MMM/yyyy:HH:mm:ss Z" ] 
     remove_field => "[time_req_rcv4c_or_snt4b]" 
     } 
    } 
    } 
} 
output { 
    if "varnish" in [tags] { 
     elasticsearch { 
     hosts => ["elasticsearch:9200"] 
     index => "logstash-varnish-%{+YYYY.MM.dd}" 
    } 
    } else { 
     elasticsearch { 
     hosts => ["elasticsearch:9200"] 
     } 
    } 

    stdout { 
     codec => rubydebug 
    } 
} 

我试过了：

match => [ "time_req_rcv4c_or_snt4b","dd/MMM/yyyy:HH:mm:ss Z" ] 
    remove_field => "time_req_rcv4c_or_snt4b" 

and

match => [ "[time_req_rcv4c_or_snt4b]","dd/MMM/yyyy:HH:mm:ss Z" ] 
    remove_field => "[time_req_rcv4c_or_snt4] 

任何人都可以解释我错过了什么。目前我没有发现任何与Google相关的内容。

Answer 1

从你的输出：

"time_req_rcv4c_or_snt4b" => "[14/Feb/2017:14:38:44 +0100]", 

您的日期字段有[]围绕它，所以你需要以匹配你的约会模式或剥夺它们赶走当你第一次匹配的日期。