如何通过logstash

Question

添加一个字段我想插入以下字段：

"date": { 
"type": "date", 
"format": "YYYY-MM-DD HH:mm:ss,SSS" 
} 

在我Logstash配置我试过如下：

grok { 
    patterns_dir => "/etc/logstash/conf.d/patterns" 
    match => { "message" => "%{USERACTIVITY}" } 
} 
mutate { 
    add_field => { 
    "type" => "date" 
    "format" => "%{date}" 
    } 
} 

mutate { 
    add_field => { 
    "timestamp" => "{ %{type} , %{fomat} }" 
    } 
} 

但它无法正常工作。是否可以从退出中添加键值对？

Answer 1

Try，

mutate { 
    add_field => { 
    "type" => "date" 
    "format" => "%{[date][format]}" 
    } 
}