解析示例
解析示例
filter {
date {
match => [ "log_ts", "ISO8601", "yyyy-MM-dd HH:mm:ss" ]
timezone => "Asia/Shanghai"
target => "@timestamp"
}
}多机房日志统一转 UTC 存入,展示层再按需转本地时间,可避免跨区域排序错乱。
把日志里的时间字符串解析成 @timestamp:格式串数组按序尝试,带时区信息才不漂移;解析失败会标记 _dateparsefailure。
filter {
date {
match => [ "log_ts", "ISO8601", "yyyy-MM-dd HH:mm:ss" ]
timezone => "Asia/Shanghai"
target => "@timestamp"
}
}