作者：star
- 软件版本
| 软件名称 | 版本号 |
|---|---|
| elasticsearch | 2.1.1 |
| logstash | 2.3.1 |
- 问题解决办法
解决方案1：
input {
jdbc {
jdbc_connection_string => "jdbc:oracle:thin:@10.35.4.97:1521:OMS1"
jdbc_driver_library => "/home/yarn/logstash-2.3.1/lib/ojdbc14.jar"
jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
jdbc_user => "ypt_jk"
jdbc_password => "ypt_jk123"
schedule => "11 18 25 11 *"
statement => "SELECT '省调' dkflag,id, '' as loglevel, CONTENT AS datastr,'oms' AS sources,'自动化' AS type ,'人工录入' as generatetype,'' AS host, to_char(RECORDDATE,'YYYY-MM-DD HH24:MI:SS') AS modifydate,RECORDUSER as RECORDUSER,recordyy AS remark FROM AUTO.T_AUTORUNRECORD"
}
}
filter {
date {
match => [ "modifydate", "yyyy-MM-dd HH:mm:ss'GMT+8'"]
target => "modifydate"
}
}
output {
elasticsearch {
document_id => "%{id}"
hosts => ["10.35.8.23:9200"]
index => "test_log"
}
stdout {
codec => json_lines
}
}
解决方案2：
input {
jdbc {
jdbc_connection_string => "jdbc:oracle:thin:@10.35.4.97:1521:OMS1"
jdbc_driver_library => "/home/yarn/logstash-2.3.1/lib/ojdbc14.jar"
jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
jdbc_user => "ypt_jk"
jdbc_password => "ypt_jk123"
schedule => "54 10 25 11 *"
statement => "SELECT '省调' dkflag,'' as loglevel,CONTENT AS datastr,'oms' AS sources,'监控' AS type,'系统生成' as generatetype,'' AS host,to_char(OPERATETIME,'YYYY-MM-DD HH24:MI:SS') AS modifydate,RECORDPERSON as RECORDUSER,'' AS remark FROM DISPATCH.T_CONTROL_LOG_CONTENT"
}
}
filter {
date {
match => [ "modifydate", "yyyy-MM-dd HH:mm:ss"]
target => "modifydate"
locale => "en"
timezone => "+00:00"
}
}
output {
elasticsearch {
hosts => ["10.35.8.23:9200"]
index => "log_t_control_log_content"
document_type => "oms_log"
}
stdout {
codec => json_lines
}
}
经测试：两种方案都可以很好的解决此问题
方案三：修改logstash源码
vi logstash-2.3.1\vendor\bundle\jruby\1.9\gems\logstash-core-event-2.3.1-java\lib\logstash\timestamp.rb
UTC = org.joda.time.DateTimeZone.forID(“UTC”)
修改为：
UTC = org.joda.time.DateTimeZone.getDefault()
相关连接：
http://www.oschina.net/question/248849_156867
https://github.com/elastic/logstash/pull/1784
http://blog.csdn.net/shan1369678/article/details/51375537
