日志内容如下
{"id":"549","msg-type":"activity","date":"1482372059180","thread-id":"628913","query-id":"16363060","user":"uuuser","priv_user":"uuuser","ip":"10.7.32.64","cmd":"show_create_table","query":"SHOW CREATE TABLE `uc_logindata`"}
搭建 elk ，但是想把 date 改成北京时间，不知道 filter 如何去写？
目前的 filter 格式如下
input {
file {
type => "mysql-audit"
path => ["/opt/audit_logs/mysql-audit/*"]
}
}
filter{
json {
source => "message"
target => "json"
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => ["172.19.11.32:9200"]
}
}
输出后的结果如下
{
"path" => "/opt/audit_logs/mysql-audit/test.json",
"@timestamp" => 2016-12-23T03:05:49.752Z,
"@version" => "1",
"host" => "0.0.0.0",
"json" => {
"date" => "1482372059180",
"query-id" => "16363060",
"msg-type" => "activity",
"ip" => "10.7.32.64",
"query" => "SHOW CREATE TABLE `uc_logindata`",
"priv_user" => "uuuser",
"id" => "7",
"cmd" => "show_create_table",
"user" => "uuuser",
"thread-id" => "628913"
},
"message" => "{\"id\":\"7\",\"msg-type\":\"activity\",\"date\":\"1482372059180\",\"thread-id\":\"628913\",\"query-id\":\"16363060\",\"user\":\"uuuser\",\"priv_user\":\"uuuser\",\"ip\":\"10.7.32.64\",\"cmd\":\"show_create_table\",\"query\":\"SHOW CREATE TABLE `uc_logindata`\"}",
"type" => "mysql-audit",
"tags" => []
}