把文本(TEXT)转成Date日期型, logstash配置怪异出错

项目里用logstash做日志解析,为了把日志时间转换成日期型,查到官方文档,加了如下一段配置:

gork {
....
}

date {
    match => [ "logDate", "yyyy-MM-dd HH:mm:ss.SSS" ]
    target => "logDate"
}
	mutate {
....
}

加好了,logstash启动不了,一真报错:

“org/logstash/execution/AbstractPipelineExt.java:189:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in initialize’”, “/opt/bitnami/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in initialize'", "/opt/bitnami/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute’”, “/opt/bitnami/logstash/logstash-core/lib/logstash/agent.rb:392:in `block in converge_state’”]}

以为是放错了地方,挪到不同的位置,结果一样,就是启动不了。偶然想到,会不会是前导缩进空格的问题呢,把前面的tab全部变成空格,再试居然可以了。

你可能感兴趣的:(elk,logstash)