Logstash学习7_Logstash_Date时间处理_Joda-Time库

filters/date 插件可以用来转换你的日志记录中的时间字符串，变成 LogStash::Timestamp 对象，然后转存到 @timestamp 字段里。

filters/date 插件支持的时间格式包括Joda-Time库：

Symbol	Meaning	Presentation	Examples
G	era	text	AD
C	century of era (>=0)	number	20
Y	year of era (>=0)	year	1996
x	weekyear	year	1996
w	week of weekyear	number	27
e	day of week	number	2
E	day of week	text	Tuesday; Tue
y	year	year	1996
D	day of year	number	189
M	month of year	month	July; Jul; 07
d	day of month	number	10
a	halfday of day	text	PM
K	hour of halfday (0~11)	number	0
h	clockhour of halfday (1~12)	number	12
H	hour of day (0~23)	number	0
k	clockhour of day (1~24)	number	24
m	minute of hour	number	30
s	second of minute	number	55
S	fraction of second	number	978
z	time zone	text	Pacific Standard Time; PST
Z	time zone offset/id	zone	-0800; -08:00; America/Los_Angeles
'	escape for text	delimiter
''	single quote	literal	'

来自：http://kibana.logstash.es/content/logstash/plugins/filter/date.html

下面，对上面的格式符进行说明：

G，公元，可以使AD（公元后）和BC（公元前）；

C，世纪（>=0），“20”代表20世纪；

Y，年（>=0），公元前或公元后的某年，“1996”表示1996年；

x，年，weekyear，后面应该跟着星期；

w，一年中第几个星期，

e，一周中第几天，表示形式为数字，

E，一周中第几天，表示形式为字母，例如“Tue”，

例如：

2002-12-30 (Monday 30th December 2002) would be represented as 2003-W01-1.

2003-01-01 (Wednesday 1st January 2003) would be represented as 2003-W01-3.

y，普通的年；

D，一年中第几天；

d，一个月中第几天；

M，月；

m，分钟；

a，上午或下午，例如PM或AM；

K，12小时制普通时间（0~11）；

H，24小时制普通时间（0~23）；

k，24小时制时钟时间（1~24）；

h，12小时制时钟时间（1~12）；

s，秒；

S，毫秒；

z，时区，太平洋标准时间；

Z，时区设置；

'，跳过内容；

''，' 符号；

Joda-Time主页：
http://www.joda.org/joda-time/
用户文档：
http://www.joda.org/joda-time/userguide.html#Fields
字段介绍：
http://www.joda.org/joda-time/field.html

MillisOfSecond

The number of milliseconds in the specified time once the second and larger parts are removed.

MillisOfDay

The number of milliseconds in the specified time once the day and larger parts are removed.

SecondOfMinute

The number of seconds in the specified time once the minute and larger parts are removed.

SecondOfDay

The number of seconds in the specified time once the day and larger parts are removed.

MinuteOfHour

The number of minutes in the specified time once the hour and larger parts are removed.

MinuteOfDay

The number of minutes in the specified time once the day and larger parts are removed.

HourOfDay

The number of hours in the specified time once the day and larger parts are removed. The clockhour value represents midnight of the current day as 24 instead of 0.

HourOfHalfday

The number of hours within the half day. The clockhour value represents midnight or noon of the current day as 12 instead of 0.

HalfdayOfDay

The AM/PM value of the day.

DayOfWeek

The day of week is defined by constants in DateTimeConstants. The values used are from the ISO8601 standard. Monday is defined as 1, through to Sunday as 7.

WeekOfWeekyear and Weekyear

A week based year is one where dates are expressed as a day of week, week number and year (week based). The following description is of the ISO8601 standard used by implementations of this method in this library.
Weeks run from 1 to 52-53 in a week based year. The first day of the week is defined as Monday and given the value 1.
The first week of a year is defined as the first week that has at least four days in the year. As a result of this definition, week 1 may extend into the previous year, and week 52/53 may extend into the following
year. Hence the need for the year of weekyear field.
For example, 2003-01-01 was a Wednesday. This means that five days, Wednesday to Sunday, of that week are in 2003. Thus the whole week is considered to be the first week of 2003. Since all weeks start on Monday,
the first week of 2003 started on 2002-12-30, ie. in 2002.
The week based year has a specific text format.

2002-12-30 (Monday 30th December 2002) would be represented as 2003-W01-1.

2003-01-01 (Wednesday 1st January 2003) would be represented as 2003-W01-3.

DayOfMonth

The day of the month. For the GJ and ISO chronologies, this will run from 1 through to 28 or 29 in February, 30 in April, June, September and November and 31 otherwise.

DayOfYear

The day of the year. This runs from 1 to 365, or 366 in leap years. The exception is when a Julian to Gregorian cutover has occurred. In that case, the count is from 1 to 355 (typically) and is unbroken.

MonthOfYear

The month of year defined by constants in DateTimeConstants. The values used are from the ISO8601 standard. January is defined as 1, through to December as 12.

Year

The year, using negative values to represent years in the previous era. For the GJ chronology, year zero is not included, unless the cutover to Gregorian is specified at or before 1 BCE. The ISO chronology always
includes the year zero.

YearOfEra

The year as generally known (always positive). Both the GJ and ISO chronologies return 1 for 1BC/BCE, 2 for 2BC/BCE etc. In other words there is no year zero and no negative value for this field.

Era

The era expressed as a constant, zero for BC/BCE, one for AD/CE.
Other chronologies should respect the convention that one is the current era and zero is the previous era. If more eras are required the values should increase numerically over time.