Logstash: How to use date/time in a filename as an imported field

问题

I have a bunch of log files that are named as 'XXXXXX_XX_yymmdd_hh:mm:ss.txt' - I need to include the date and time (separate fields) from the filename in fields that are added to Logstash.

Can anyone help?

Thanks

回答1:

Use a grok filter to extract the date and time:

filter {
  grok {
    match => [
      "path",
      "^%{GREEDYDATA}/[^/]+_%{INT:date}_%{TIME:time}\.txt$"
    ]
  }
}

Depending on what goes instead of XXXXXX_XX you might prefer a stricter expression. Also, GREEDYDATA isn't very efficient. This might yield better performance:

filter {
  grok {
    match => [
      "path", "^(?:/[^/]+)+/[^/]+_%{INT:date}_%{TIME:time}\.txt$"
    ]
  }
}

来源：https://stackoverflow.com/questions/28277045/logstash-how-to-use-date-time-in-a-filename-as-an-imported-field