通过日志里的时间戳替换logstash处理生成的时间戳

小白叨叨

于 2019-04-12 16:09:25 发布

阅读量2.5k

点赞数

分类专栏： elk 文章标签：通过日志里的时间戳替换logstash处理生成的时间戳

本文链接：https://blog.youkuaiyun.com/wzf862187413/article/details/89243464

版权

日志格式如下所示：

Apr 12 01:09:55 swarm1 chronyd[599]: Source 5.79.108.34 online
Apr 12 01:09:55 swarm1 chronyd[599]: Source 13.55.50.68 online
Apr 12 01:09:55 swarm1 nm-dispatcher: req:8 'connectivity-change': start running ordered scripts...
Apr 12 01:09:55 swarm1 systemd: Started LSB: Bring up/down networking.
Apr 12 01:09:55 swarm1 avahi-daemon[553]: Registering new address record for fe80::6d42:77ba:70b6:b396 on ens33.*.
Apr 12 01:10:25 swarm1 systemd: Started Session 15 of user root.
Apr 12 01:10:25 swarm1 systemd: Starting Session 15 of user root.
Apr 12 01:10:41 swarm1 systemd: Started Session 16 of user root.
Apr 12 01:10:41 swarm1 systemd-logind: New session 16 of user root.
Apr 12 01:10:41 swarm1 systemd: Starting Session 16 of user root.
Apr 12 01:10:41 swarm1 gdm-launch-environment]: AccountsService: ActUserManager: user (null) has no username (object path: /org/freedesktop/Accounts/User0, uid: 0