logstash 默認時間少8小時的修改辦法

logstash 的配置文件添加

filter {

ruby {
code => "event.set('timestamp', event.get('@timestamp').time.localtime + 8*60*60)"
}
ruby {
code => "event.set('@timestamp',event.get('timestamp'))"
}
mutate {
remove_field => ["timestamp"]
}

}

 

這樣output 輸出的時間才是正確的，前提服務器時區已經修改了

output:

file{
path => "/data/logs/service/stdout-%{+YYYY-MM-dd-HH}.log"
codec => line {
format => "%{message}"
}
}