Question

尝试将日期和时间字段组合到@timestamp。这是我正在加载的csv文件。

     Date,Time,SWR,RSSI(dB),RxBt(V),Cels(gRe),Tmp2(@C),RPM(rpm),Tmp1(@C),Rud,Ele,Thr,Ail,S1,S2,S3,LS,RS,SA,SB,SC,SD,SE,SF,SG,SH,
2016-02-21,04:11:14.640,30,75,5.2,23.4,0,0,0,0,0,0,0,0,0,0,0,0,-1,-1,-1,-1,-1,-1,-1,-1,

这是负载配置：

     input {  
      file {
      path => "/home/bkelley6/flights/*.csv"
      type => "flights"
      start_position => "beginning"
  }
}

filter {  
csv {
    columns => ["Date", "Time", "SWR", "RSSI(dB)", "RxBt(V)", "Cels(gRe)", "Tmp2(@C)", "RPM(rpm)", "Tmp1(@C)", "Rud", "Ele", "Thr", "Ail", "S1", "S2", "S3", "LS", "RS", "SA", "SB", "SC", "SD" ,"SE", "SF", "SG", "SH"]
    separator => ","
}

mutate {
    replace => [ "datetime", "%{Date} %{Time}" ]
    }

date {
   match => [ "datetime", "YYYY-MM-dd HH:mm:ss.SSS" ]
   timezone => "America/New_York"
   target => "@timestamp"
  }
}
output {  
     elasticsearch {
        action => "index"
        hosts => ["localhost:9200"]
        index => "logstash-%{+YYYY.MM.dd}"
        workers => 1
    }
}

这是错误msessages：

Failed parsing date from field {:field=>"datetime", :value=>"Date Time", :exception=>"Invalid format: \"Date Time\"", :config_parsers=>"YYYY-MM-dd HH:mm:ss.SSS", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"datetime", :value=>"2016-02-21 04:2016-02-21", :exception=>"Invalid format: \"2016-02-21 04:2016-02-21\" is malformed at \"16-02-21\"", :config_parsers=>"YYYY-MM-dd HH:mm:ss.SSS", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"datetime", :value=>"2016-02-21 17:2016-02-21", :exception=>"Invalid format: \"2016-02-21 17:2016-02-21\" is malformed at \"16-02-21\"", :config_parsers=>"YYYY-MM-dd HH:mm:ss.SSS", :config_locale=>"default=en_US", :level=>:warn}

我做错了什么？

Logstash csv文件作为时间戳

0 个答案: