http://niyanchun.com/modify-attimestamp-field-in-logstash.html zh-CN Logstash在处理数据的时候，会自动生成一个字段@timestamp，默认该字段存储的是Logstash收到消息/事件(event)的时间。很多时候我们用ELK是处理日志的，日志里面一般都是... Wed, 25 Aug 2021 17:12:44 +0800 Wed, 25 Aug 2021 17:12:44 +0800 http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-690 http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-690 Wed, 25 Aug 2021 17:12:44 +0800 NYC 变了呀，业务时间就指的是日志里面的时间，默认是采集时间

]]> http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-690#comments http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-689 http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-689 Sat, 21 Aug 2021 09:34:05 +0800 bekey 是我看花眼了吗，@timestamp始终没见转换为实际业务时间啊

]]> http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-689#comments http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-598 http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-598 Wed, 13 May 2020 10:10:35 +0800 NYC 主要原因还是按照最佳实践都应该用UTC时间，所以需求按照最佳实践来说不是很重要

]]> http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-598#comments http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-592 http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-592 Fri, 27 Mar 2020 10:55:59 +0800 W_Z_C 果然可以，看了半天文档竟然没有发现这个插件，也是醉了……

]]> http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-592#comments http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-535 http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-535 Tue, 05 Feb 2019 11:06:15 +0800 NYC @timestamp的格式好像是不能改的，至少Date插件里面没有提供修改的方式。

]]> http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-535#comments http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-534 http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-534 Fri, 01 Feb 2019 12:22:04 +0800 VPS234 这个时间格式可以改的吧

]]> http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-534#comments http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-512 http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-512 Wed, 28 Nov 2018 09:08:42 +0800 NYC 个人觉得这个东西应该让用户可以指定，虽然用date插件可以实现，但还是麻烦

]]> http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-512#comments http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-511 http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-511 Wed, 28 Nov 2018 09:07:54 +0800 NYC 客气~

]]> http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-511#comments http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-510 http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-510 Wed, 28 Nov 2018 08:20:23 +0800 guankai 这个我前两天也刚好搞了。。

]]> http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-510#comments http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-509 http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-509 Fri, 16 Nov 2018 20:14:55 +0800 kubaoya 学习，谢谢分享

]]> http://niyanchun.com/modify-attimestamp-field-in-logstash.html/comment-page-1#comment-509#comments