@timestamp获取message时间

 date {



        match => ["logdate", "yyyy-MM-dd HH:mm:ss.SSS"]



        target => "@timestamp"



    }

filter {

    grok {

        match => ["message", "(?<logdate>\d{2}:\d{2}:\d{2}\.\d{3})"]

    }

    mutate {

       add_field => {"new_logdate" => "%{+YYYY-MM-dd} %{logdate}"}

    }

    date {

        match => ["new_logdate", "yyyy-MM-dd HH:mm:ss.SSS"]

        target => "@timestamp"

    }

}