Shulou(Shulou.com)06/01 Report--

Because logstash will automatically convert @ timestamp time to UTC time, many methods have been searched on the Internet without results. We have to extract the year, month and day from the log and classify them according to Beijing time.

Log format JSON:

{"@ timestamp": "2016-08-22T09:13:06.024Z" .} input {redis {host = > "192.168.1.21" port = > "6379" key = > "filebeat" data_type = > "list" password = > "nginx_pass" threads = > 50}} filter {mutate {gsub = > ["message", "\\ x" "\\ x"]} if [type] = = "nginxacclog" {json {source = > "message"} ruby {code = > "event ['ctime'] = event [' @ timestamp'] .time.localtime" # code = > "event ['ctime'] = event [' @ timestamp']. Time.localtime + 8" 60 timestamp' "} grok {match = > {" ctime "= > ["% {INT:years_dik3k} -% {INT:months_dik3k} -% {INT:days_dik3k} T* "]} } grok {add_field = > ["type_xi09wnk" "nginxacclog"] match = > ["requesturi", "% {URIPATH:baseurl} (?:% {NOTSPACE:request})"] remove_tag = > "requesturi"} kv {source = > "request" field_split = > "&?" Value_split = > "="} kv {source = > "post_requ" field_split = > "&?" Value_split = > "="}} output {if [type_xi09wnk] = = "nginxacclog" {mongodb {collection = > "nginx_log% {years_dik3k}% {months_dik3k}% {days_dik3k}" isodate = > true database = > "logdb" uri = > "mongodb://user:pass@10.10.1.102:27017/logdb"}}

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.