logstash 中filter中的date插件

"RECEIVE_TIME": "2017-11-26T22:11:47.000Z",

时间转化为中间带T格式时间

filter{

date{

     

1. match => ["logdate", "dd/MMM/yyyy:HH:mm:ss Z"]  
2. add_field =>["RECEIVE_TIME","%{logdate}"]  

}

}

等价于

filter{

date{

     match => ["RECEIVE_TIME","dd/MMM/yyy:HH:mm:ss Z"]

     target =>  "RECEIVE_TIME"

}

}

logstash 中filter中date多个字段需要格式时间，只能一个date里边只能一个match和一个target

 date {
            match => ["RECEIVE_TIME", "yyyyMMddHHmmss"]
            target => "RECEIVE_TIME"
    }
    date{
            match => ["START_DATE", "yyyyMMddHHmmss"]
            target => "START_DATE"
    }

不能为这种格式

 date {
            match => ["RECEIVE_TIME", "yyyyMMddHHmmss"]
            target => "RECEIVE_TIME"
            match => ["START_DATE", "yyyyMMddHHmmss"]
            target => "START_DATE"
    }