Question

我通过Logstash发送到TCP json。我想将字段"timestamp"添加到JSON，并将日期设为长

body.put("timestamp", new Date().getTime());

在logstash中，我看到此字段为Number。如何将timestamp映射到logstash @timestamp或手动设置@timestamp。我无法更改Logstash配置。

数据输入示例：

{
"@message":{
"path":"*****$1:101",
"text":"TEST ERROR 0"
},
"@timestamp":"2018-07-14T22:54:27.579+0300",
"level":"ERROR",
"@tags":["test","java",],
"type":"logs"
}

在kibana中的数据输出JSON：

{
  "_index": "logs-2018.07.14",
  "_type": "doc",
  "_id": "STdjmmQB0QygPx38jLkS",
  "_version": 1,
  "_score": null,
  "_source": {
    "@version": "1",
    "@timestamp": "2018-07-14T20:02:30.091Z",
    "@message": {
      "path": "path",
      "requestId": "423-423",
      "text": "test"
    },
    "level": "INFO",
    "@tags": [
      "test",
      "java"
    ],
    "host": "*.*.*.*",
    "type": "logs",
    "port": 56549
  },
  "fields": {
    "@timestamp": [
      "2018-07-14T20:02:30.091Z"
    ]
  },
  "sort": [
    1531598550091
  ]
}

P.S。我需要自己的timestamp，因为我在线程池中发送消息，而且我可能会失去顺序。

Answer 1

解决方案是将字段@timestamp添加到根json节点并以yyyy-MM-dd'T'HH:mm:ss.SSSZ格式设置日期示例：

{
"@message":{
"path":"*****$1:101",
"text":"TEST ERROR 0"
},
"@timestamp":"2018-07-14T22:54:27.579+0300",
"level":"ERROR",
"@tags":["test","java"],
"type":"logs"
}

ELK自定义日期

1 个答案: