下面比較 nginx配置中輸出日誌格式的時間欄位在兩種格式下的解析方法：

$time_iso8601

log_format json '{"@timestamp":"$time_iso8601",'
                 '"host":"$server_addr",'
                 '"clientip":"$remote_addr",'
                 '"request":"$request",'
                 '"status":"$status",'
                 '"request_method": "$request_method",'
                 '"size":"$body_bytes_sent",'
                 '"request_time":"$request_time",'
                 '"upstreamtime":"$upstream_response_time",'
                 '"upstreamhost":"$upstream_addr",'
                 '"http_host":"$host",'
                 '"url":"$uri",'
                 '"http_forward":"$http_x_forwarded_for",'
                 '"referer":"$http_referer",'
                 '"agent":"$http_user_agent"}';

access_log  /var/log/nginx/access.log json ;
 

此時，日誌中的時間格式為”2017-01-17T16:51:42+08:00” logstash解析該時間格式配置如下，此時時間戳timestamp採用locals：

filter {
    grok {
        match => { "message" => "%{TIMESTAMP_ISO8601:locals}" }
    }
    date {
        locale => "en"
        match => [ "locals", "ISO8601"]
    }
}
 

輸入：2017-01-17T11:53:13+08:00 輸出：

{
“@timestamp” => 2017-01-17T00:08:41.000Z,
“@version” => “1”,
“host” => “elk.dev”,
“message” => “2017-01-17T08:08:41+08:00”,
“locals” => “2017-01-17T08:08:41+08:00”,
“tags” => []
}

$time_local nginx配置使用該變數時時間格式為“17/Jan/2017:17:14:08 +0800” 此格式相應的logstash配置如下，

filter {
    grok {
        match => ["message", "%{HTTPDATE:logdate}"]
    }
    date {
        locale => "en"
        match => ["logdate", "dd/MMM/yyyy:HH:mm:ss Z"]
    }
}
 

輸入：17/Jan/2017:17:11:10 +0800 輸出：

{
“@timestamp” => 2017-01-17T09:11:10.000Z,
“logdate” => “17/Jan/2017:17:11:10 +0800”,
“@version” => “1”,
“host” => “elk.dev”,
“message” => “17/Jan/2017:17:11:10 +0800”,
“tags”