我们都知道如果文档中有表示时间的字段时可以用如下方法将字段转化为date(timestamp)格式导入
date {
match => [ "submission_time", "yyyyMMdd" ]
}date {
match => [ "submission_time", "UNIX_MS" ]
target => "@timestamp"
}
date {
match => [ "submission_time", "UNIX_MS" ]
target => "submission_time"
}
date {
match => [ "start_time", "UNIX_MS" ]
target => "start_time"
}
date {
match => [ "end_time", "UNIX_MS" ]
target => "end_time"
}
[尊重社区原创，转载请保留或注明出处]
本文地址：http://searchkit.cn/article/150
本文地址：http://searchkit.cn/article/150
1 个评论
嗯 但是转换后的时间都是为UTC时间 如何获取东八区的时间呢？貌似设置timeone不管用
