logstash 给时间字段增加8小时的方法_糯米鸡的博客

filter {
	if [type] == "appstart" {
		json {
			source => "message"
			remove_field => ["message"]
		}
		date {
			match => ["createTime", "yyyy-MM-dd HH:mm:ss"]
			timezone => "+00:00"
		}

		if [cusPhone] == "null" {
			mutate {
				update => ["cusPhone", ""]
			}
		}
}filter {
	if [type] == "appstart" {
		json {