如何在logstash中获取字段值？答案

【问题标题】：how to get field value in logstash?如何在logstash中获取字段值？
【发布时间】：2016-04-29 18:42:33
【问题描述】：

从我的输出如下，

"消息" =>"<.......> "@version" => "1",
"@timestamp" => "2016-04-29T02:33:34.586Z",
"时间戳" => "4 月 29 日 10:30:37",
"syslog_severity_code" => 5,
"syslog_facility_code" => 1,
"syslog_facility" => "用户级别",
"syslog_severity" => "通知"

我尝试获取字段值

filter
 {
    mutate {
    add_field => {"newfield"=> "timestamp"}
 }

但仍然无法获取新字段的时间戳值它会得到 p>

"newfield" => "newfield",

是否有人遇到同样的问题或找到解决方案？欢迎任何帮助来解决这个问题。

【问题讨论】：

标签： logstash

【解决方案1】：

这很简单，你可以这样做：

filter
 {
   mutate {
    add_field => ["newfield"=> "%{timestamp}"]
 }

你可以得到：

   "message" => "test it \b\b",
  "@version" => "1",
"@timestamp" => "2016-04-28T09:16:56.934Z",
      "host" => "bag",
 "timestamp" => "Apr 29 10:30:37",
 "new_field" => "Apr 29 10:30:37"

【讨论】：