logstash数据处理示例

#test {"time":1504752032399,"date":"2017-09-08 12:00:00","str":"ddse\r\n}

input {
    stdin {
     codec => json }
}

filter {
   mutate {
      add_field => {
           "field1" => "%{time}"
       }
   }
  date {
     match => ["date","YYYY-MM-dd HH:mm:ss"]
     timezone => "+00:00"
     target =>"logdate"
  }
  ruby {
     code => "
               event.set('field2', Time.at(event.get('@timestamp').to_f+8*60*60))
               timestamp=Time.at(event.get('time').to_f/1000 + 8*60*60)
               event.set('timestamp',timestamp)
               event.set('@timestamp',event.get('timestamp'))
               event.set('string_length',event.get('str').lstrip.rstrip.length)
              "
  }
}

output {
    stdout {
     codec => rubydebug
    }
}