按照官方的配置，获取时间并转换成时间格式，一直报错
date {
target => "runtime"
match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
}
错误如下：
Failed parsing date from field {:field=>"timestamp", :value=>"02/Dec/2014:16:52:43 +0800", :exception=>java.lang.IllegalArgumentException: Invalid format: "02/Dec/2014:16:52:43 +0800" is malformed at "Dec/2014:16:52:43 +0800", :level=>:warn}
date {
target => "runtime"
match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
}
错误如下：
Failed parsing date from field {:field=>"timestamp", :value=>"02/Dec/2014:16:52:43 +0800", :exception=>java.lang.IllegalArgumentException: Invalid format: "02/Dec/2014:16:52:43 +0800" is malformed at "Dec/2014:16:52:43 +0800", :level=>:warn}
2 个回复
kennywu76 - Wood
赞同来自: Rubricate 、sky7644 、lz8086 、sailershen
解决办法为在date filter里加一个locale=>"en"的设置：
filter {
date {
locale => "en"
..............
}
}
Rubricate - hi
赞同来自: 婚格线 、lz8086 、Dm
date {
target => "runtime"
locale => en
match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
}
解析时间用到了时区