Logstash add date field to logs -
my application produces logs, without timestamp. there way in logstash append timestamp logs on processing
something like,
mutate { add_field => { "timestamp" => "%{date}" } }
logstash adds @timestamp
field default. don't need set additional. logstash take time event received , add field you.
for example if try command:
ls_home/bin/logstash -e 'input { stdin {} } output { stdout { codec => rubydebug } }'
you see automatically created @timestamp
field in result:
"@timestamp": "2015-07-13t17:41:13.174z"
you can change format , timezone using date filter or can match timestamp of event (e.g. syslog timestamp) using other filters grok or json.
Comments
Post a Comment