年度翻转的logstash时间戳

我们使用 logstash 来存储/搜索来自我们邮件服务器的日志。我今天注意到今年（2015 年）我们没有任何指数。快速调查显示当前日志存储为 2014.01.05（即同一天但去年），并且这些索引正在被查找旧索引的 cron 作业删除。

重新启动 logstash 修复了一些问题，所以我假设 logstash 正在根据它开始的时间填写年份信息。

我们使用 Elasticsearch 1.2.4 运行 Logstash 1.4.1。所以不是最新版本的 Elasticsearch，但我在 1.4.2 的更新日志中看不到任何相关内容。

使用下面的 syslog - config 将日志条目连同输入行和解析输出的示例一起发送到 logstash。

有没有比记得在元旦重新启动 Logstash 更好的解决方法？

输入线示例

Jan  5 15:03:35 cheviot22 exim[15034]: 1Y89Bv-0003uU-DD <= [email protected] H=adudeviis.ncl.ac.uk (campus) [10.8.232.56] P=esmtp S=2548 [email protected]

{
  "_index": "logstash-2014.01.05",
  "_type": "mails",
  "_id": "HO0TQs66SA-1QkQBYd9Jag",
  "_score": null,
  "_source": {
    "@version": "1",
    "@timestamp": "2014-01-05T15:03:35.000Z",
    "type": "mails",
    "priority": 22,
    "timestamp": "Jan  5 15:03:35",
    "logsource": "cheviot22",
    "program": "exim",
    "pid": "15034",
    "severity": 6,
    "facility": 2,
    "facility_label": "mail",
    "severity_label": "Informational",
    "msg": "1Y89Bv-0003uU-DD <= [email protected] H=adudeviis.ncl.ac.uk (campus) [10.8.232.56] P=esmtp S=2548 [email protected]",
    "tags": [
      "grokked",
      "exim_grokked",
      "dated"
    ],
    "xid": "1Y89Bv-0003uU",
    "exim_rcpt_kv": "[email protected] H=adudeviis.ncl.ac.uk (campus) [10.8.232.56] P=esmtp S=2548 [email protected]",
    "H": "adudeviis.ncl.ac.uk",
    "P": "esmtp",
    "S": "2548",
    "id": "[email protected]"
  },
  "sort": [
    1388934215000,
    1388934215000
  ]
}

Logstash 配置（删除了不相关的位）...

input {
    syslog {
        codec => "plain"
        debug => false
        port => 514
        type => "mails"
    }
}

filter {
    mutate {
        remove_field => [ "path", "host" ]
    }

    if [type] == "mails" {
        grok {
            patterns_dir => [ "/etc/logstash/patterns" ]
            match => [ "message",  "(?<msg>.*)" ]
            add_tag => [ "grokked" ]
            break_on_match => true
            remove_field => [ "message" ]
        }
    }

    date {
        match => [ "timestamp", "ISO8601", "MMM dd HH:mm:ss", "MMM  d HH:mm:ss"]
        add_tag => [ "dated" ]
    }
}

output {
        elasticsearch {
                cluster => "logstash"
        host => "iss-logstash01"
        flush_size => 1000
        index => "logstash-%{+YYYY.MM.dd}"
        }
}