filter {
json {
source => "message"
remove_field => ["message"]
remove_field => ["@version"]
remove_field => ["path"]
remove_field => ["@timestamp"]
add_field => { "proCode" => "10" }
}
ruby {
code => "responseReceivedTime = event.get('responseReceivedTime')
localtimeStr = responseReceivedTime.strftime('%s')
event.set(responseReceivedTime, 'localtimeStr')"
}
}
json {
source => "message"
remove_field => ["message"]
remove_field => ["@version"]
remove_field => ["path"]
remove_field => ["@timestamp"]
add_field => { "proCode" => "10" }
}
ruby {
code => "responseReceivedTime = event.get('responseReceivedTime')
localtimeStr = responseReceivedTime.strftime('%s')
event.set(responseReceivedTime, 'localtimeStr')"
}
}
0 个回复