五分鐘帶你玩轉Elasticsearch（十五）logstash中@timestamp時區早8個小時解決方案

修改/logstash/bin中的配置檔案 在filter中添加

ruby { 
                 code => "event.set('timestamp', event.get('@timestamp').time.localtime + 8*60*60)" 
             }
             ruby {
                 code => "event.set('@timestamp',event.get('timestamp'))"
             }
             mutate {
                 remove_field => ["timestamp"]
             }