ログスタッシュで@timestampを置き換えてください。

Question

私のlogstasg設定でうっとりしています。

私は別で@timestampフィールドを交換する方法を見つけることができません。ここで

は受信logstashものです：ここでは

{ 
          "offset" => 6718968, 
        "Varnish_txid" => "639657758", 
         "plateform" => "cdnfronts", 
         "Referer" => "-", 
         "input_type" => "log", 
         "respsize" => "281", 
          "source" => "/var/log/varnish/varnish4xx-5xx.log", 
           "UA" => "Microsoft-WebDAV-MiniRedir/5.1.2600", 
          "type" => "varnish-logs", 
          "tags" => [ 
     [0] "json", 
     [1] "varnish", 
     [2] "beats_input_codec_json_applied", 
     [3] "_dateparsefailure" 
    ], 
      "st_snt2c_or_sntfromb" => "405", 
         "RemoteHost" => "32.26.21.21", 
         "@timestamp" => 2017-02-14T13:38:47.808Z, 
       "Varnish.Handling" => "pass", 
    "tot_bytes_rcvby_c_or_sntby_b" => "-", 
     "time_req_rcv4c_or_snt4b" => "[14/Feb/2017:14:38:44 +0100]", 
         "@version" => "1", 
          "beat" => { 
     "hostname" => "cdn1", 
      "name" => "cdn1", 
     "version" => "5.1.2" 
    }, 
          "host" => "cdn1", 
        "time_1st_byte" => "0.010954", 
        "Varnish_side" => "c", 
        "reqfirstline" => "OPTIONS http://a.toto.com/ HTTP/1.1" 
} 

は私のlogstash confにある：

input { 
    beats { 
     port => 5000 
     codec => "json" 
     ssl => true 
     ssl_certificate => "/etc/logstash/ssl/logstash-forwarder.crt" 
     ssl_key => "/etc/logstash/ssl/logstash-forwarder.key" 

    } 
} 
filter { 
    if "json" in [tags] { 
    json { 
     source => "message" 
    } 
    if "varnish" in [tags] { 
    date { 
     locale => "en" 
     match => [ "[time_req_rcv4c_or_snt4b]","dd/MMM/yyyy:HH:mm:ss Z" ] 
     remove_field => "[time_req_rcv4c_or_snt4b]" 
     } 
    } 
    } 
} 
output { 
    if "varnish" in [tags] { 
     elasticsearch { 
     hosts => ["elasticsearch:9200"] 
     index => "logstash-varnish-%{+YYYY.MM.dd}" 
    } 
    } else { 
     elasticsearch { 
     hosts => ["elasticsearch:9200"] 
     } 
    } 

    stdout { 
     codec => rubydebug 
    } 
} 

私は試しました：

match => [ "time_req_rcv4c_or_snt4b","dd/MMM/yyyy:HH:mm:ss Z" ] 
    remove_field => "time_req_rcv4c_or_snt4b" 

と

match => [ "[time_req_rcv4c_or_snt4b]","dd/MMM/yyyy:HH:mm:ss Z" ] 
    remove_field => "[time_req_rcv4c_or_snt4] 

誰も私が逃したものを私に説明することができます。私はその時点でgoogleに関連するものは見つけられませんでした。あなたの出力から

Answer 1

：

"time_req_rcv4c_or_snt4b" => "[14/Feb/2017:14:38:44 +0100]", 

はあなたの日付フィールドは、その周りに[]があるので、あなたの日付パターンのものと一致するか、またはあなたが最初の日付と一致したときに、それらを取り除く必要があります。