Filebeat 中時間戳的精度調整方法通常有以下幾種方式:
output.elasticsearch:
hosts: ["localhost:9200"]
pipeline: "my_pipeline"
index: "my_index-%{+yyyy.MM.dd}"
template.name: "my_template"
template.overwrite: false
template.enabled: false
setup.kibana.host: "http://localhost:5601"
indices:
- index: "my_index-%{+yyyy.MM.dd}"
when.equals:
event.module: "my_module"
logging.level: debug
logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0644
rotateeverybytes: 10485760
level: debug
setup.template.settings:
index.number_of_shards: 1
index.codec: best_compression
_source.enabled: true
setup.ilm.enabled: false
processors:
- add_host_metadata:
target: my_field
filter {
date {
match => ["timestamp", "ISO8601"]
target => "@timestamp"
}
}
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp}" }
}
date {
match => ["timestamp", "ISO8601"]
target => "@timestamp"
}
}
通過以上方法,可以實現對 Filebeat 中時間戳精度的調整和處理,從而滿足不同需求下對時間戳的要求。