在logstash中解析特定日期

Question

我正在尝试用logstash解析以下日期 2019-08-01T00：00：00Z / 2019-08-02T00：00：00Z

我尝试了多种方法，但没有任何效果

选项1

date{
match => ["timestamp","ISO8601/ISO8601"]
    target => "timestamp"
  }

选项2

date{
match => ["timestamp","ISO8601"]
    target => "timestamp"
  }    

选项3-管道有效，但出现dateparsefailure

date{
match => ["timestamp","ISO8601"/"ISO8601"]
    target => "timestamp"
  }

Answer 1

如何使用grok模式将日期收集到单独的字段中，然后使用mutate将它们联接起来

filter {  
  grok {
    match => [ "message", "%{TIMESTAMP_ISO8601:date_1}/%{TIMESTAMP_ISO8601:date_2}" ]
    tag_on_failure => [ "_failure", "_grokparsefailure" ]
  }

  if "_failure" not in [tags] {
    mutate {
      add_field => { "timestamp" => "%{date_1}/%{date_2}"}
    }
  }
}