Logstash grok 日期解析失败答案

【问题标题】：Logstash grok date parsefailureLogstash grok 日期解析失败
【发布时间】：2018-07-11 02:54:19
【问题描述】：

使用此过滤器

filter
{
  grok{
    match => { "message" => "\[(?<timestamp>%{MONTHDAY}-%{MONTH}-%{YEAR} %{TIME} %{TZ})\] %{DATA:errortype}: %{GREEDYDATA:errormessage}"}
  }
  date {
    match => [ "timestamp" , "dd-MMM-YYYY HH:mm:ss Z" ]
    #remove_field => ["timestamp"]
  }
}

还有这一行

[04-Jul-2018 15:28:02 UTC] PHP Warning:  count(): Parameter must be an array or an object that implements Countable in xxx.php on line 508

我的日期解析失败

https://grokdebug.herokuapp.com/ 似乎一切正常，使用 -debug 我只有这个日志

[2018-07-09T08:38:32,925][DEBUG][logstash.inputs.file     ] Received line {:path=>"/tmp/request.log", :text=>"[04-Jul-2018 15:28:02 UTC] PHP Warning:  count(): Parameter must be an array or an o
bject that implements Countable in xxx/program.php on line 508"}
[2018-07-09T08:38:32,941][DEBUG][logstash.inputs.file     ] writing sincedb (delta since last write = 1531118312)
[2018-07-09T08:38:32,948][DEBUG][logstash.pipeline        ] filter received {"event"=>{"@version"=>"1", "host"=>"guillaume", "path"=>"/tmp/request.log", "@timestamp"=>2018-07-09T06:38:32.939Z, "
message"=>"[04-Jul-2018 15:28:02 UTC] PHP Warning:  count(): Parameter must be an array or an object that implements Countable in xxx.php on line 508"}}
[2018-07-09T08:38:32,949][DEBUG][logstash.filters.grok    ] Running grok filter {:event=>2018-07-09T06:38:32.939Z guillaume [04-Jul-2018 15:28:02 UTC] PHP Warning:  count(): Parameter must be an
 array or an object that implements Countable in xxx/program.php on line 508}
[2018-07-09T08:38:32,950][DEBUG][logstash.filters.grok    ] Event now:  {:event=>2018-07-09T06:38:32.939Z guillaume [04-Jul-2018 15:28:02 UTC] PHP Warning:  count(): Parameter must be an array o
r an object that implements Countable in xxx.php on line 508}
[2018-07-09T08:38:32,954][DEBUG][logstash.pipeline        ] output received {"event"=>{"errormessage"=>" count(): Parameter must be an array or an object that implements Countable xxx.php on line 508", "path"=>"/tmp/request.log", "errortype"=>"PHP Warning", "@timestamp"=>2018-07-09T06:
38:32.939Z, "@version"=>"1", "host"=>"guillaume", "message"=>"[04-Jul-2018 15:28:02 UTC] PHP Warning:  count(): Parameter must be an array or an object that implements Countable in xxx.php on line 508", "timestamp"=>"04-Jul-2018 15:28:02 UTC", "tags"=>["_dateparsefailure"]}}

【问题讨论】：

标签： logstash logstash-grok

【解决方案1】：

date {
    match => [ "timestamp" , "dd-MMM-yyyy HH:mm:ss z" ]
}

将YYYY 更改为yyyy，将Z 更改为z。

有关日期格式的更多详细信息，您可以参考以下页面：->

https://www.elastic.co/guide/en/logstash/6.3/plugins-filters-date.html#plugins-filters-date-match

【讨论】：