Use Logstash to fetch a datetime type number from MySQL. In stdout view the data JSON format takes a field value similar to
2018-03-23T04:18:33.000Z
, because you want to use this field as a @timestamp, use the date of Logstash to match.
date { match => ["start_time","ISO8601"] }
But the actual discovery of each document will be accompanied [_dataparserfail]
by a label, Miss no Sister
Google after a while finally understand, Link: HTTPS://DISCUSS.ELASTIC.CO/T/TROUBLE-MATCHING-TIMESTAMP/83768/4
Because the data from MySQL Start_time is already a time data type, then use date to deal with the natural failure, if you want to use this field as a @timestamp, the solution for foreigners is as follows:
In your SQL query, typecast the timestamp as a string.
Use a mutate filter's convert option to typecast the field to a string prior to the date filter.
Use a mutate filter to copy the timestamp into @timestamp and overwrite the existing value (with the Replace option).
I use the method:
mutate { add_field => {"temp_ts" => "%{start_time}"} } date { match => ["temp_ts","ISO8601"] remove_field => ["temp_ts"] }
LOGSTASH-INPUT-JDBC take MySQL data date format processing