Logstash date issue


(aabababba) #1
date {
       match => ["logtime","HH:mm:ss,SSS","ISO8601"]
       target => "logtime1"
       locale => "cn"
       timezone => "Asia/Shanghai"
     }

now result become

logtime
13:43:12,009

logtime1
2018-01-01T05:43:12.009Z

anyidea?


(Andreas H) #2

That is correct.
All timestamps are saved in UTC.


(aabababba) #3

but date not correct, it is 2018-11-30 not 2018-01-01


#4

me too,In Mysql the time type is timestamp,sync to es,the time zone is 00:00,
example: last_login_time => 2018-03-22T21:51:51.000Z,which format i should be use?


(aabababba) #5

兄弟,你咋取的时间值。。。


#6

时间类型在MySQL中是timestamp,不做任何处理的话,转存到ES后,有个时区的时差,现在想通过date的filter解决,发现格式不匹配~~~ 同步到ES中的格式为 : 2018-11-16T08:00:01.000Z


#7

这个是官网的示例:https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html


(aabababba) #8

你原来日志时间格式是2018-11-16 08:00:01了?
我用date插件也没成功。。。


#9

准确点说 是的 但就是format失败 搞不懂了~~~ QQ: 396034282


#10

其实,使用以下方式可以实现,但我觉得太过繁琐,应该在date中有什么更好的设置,但目前还没找到