代码之家  ›  专栏  ›  技术社区  ›  suren

ELK-date,在logstash中定义,在kibana中显示为字符串

  •  0
  • suren  · 技术社区  · 5 年前

    我有以下logstash配置文件:

    input {
        file {
            path => "/home/elk/data/visits.csv"
            start_position => "beginning"
            sincedb_path => "NUL"
        }
    }
    
    filter {
        csv {
            separator => ","
            columns => ["estado","tiempo_demora","poblacion","id_poblacion","edad_valor","cp","latitude_corregida","longitud_corregida","patologia","Fecha","id_tipo","id_personal","nasistencias","menor","Geopoint_corregido"]
        }
        date {
            match => ["Fecha","dd-MM-YYYY HH:mm"]
            target => "Fecha"
        }
        mutate {convert => ["nasistencias", "integer"]}
        mutate {convert => ["id_poblacion", "integer"]}
        mutate {convert => ["id_personal", "integer"]}
        mutate {convert => ["id_tipo", "integer"]}
        mutate {convert => ["cp", "integer"]}
        mutate {convert => ["edad_valor", "integer"]}
        mutate {
            convert => { "longitud_corregida" => "float" }
            convert => { "latitude_corregida" => "float" }
        }
        mutate {
          rename => {
              "longitud_corregida" => "[location][lon]"
              "latitude_corregida" => "[location][lat]"
          }
        }
    }
    
    output {
        elasticsearch {
            hosts => ["localhost:9200"]
            index => "medicalvisits-%{+dd.MM.YYYY}"
        }
        stdout {
            codec => json_lines
            codec => rubydebug
        }
    }
    

    从那里 Fecha date ,但在kibana中,当我尝试将其设置为timestamp时,它不会显示,而是显示为string:

    enter image description here

    1 回复  |  直到 5 年前
        1
  •  0
  •   carrotcakeslayer    5 年前

    索引模式中的类型与索引模板中的类型(实际存储的信息)不同。

    我建议您用日志存储发送的信息覆盖时间戳。毕竟,在大多数情况下,对你来说重要的是事件的时间戳,而不是事件发送到你的elasticsearch的时间戳。

        date {
        match => ["Fecha","dd-MM-YYYY HH:mm"]
        target => "@timestamp"
        tag_on_failure => ["fallo_filtro_fecha"]
    

    如果您真的需要带有@timestamp的“Fecha”algonside(不是最好的主意),并且Fecha是“date”类型,那么另一个选项是修改索引映射,将该字段类型更改为date。像这样(根据需要调整):

    PUT /nombre_de_tu_indice/_mapping
    {
      "properties": {
        "Fecha": {
          "type": "date",
        }
      }
    }
    

    当然,这种更改只会影响新的索引或重新索引的索引。