将秒数从秒更改为毫秒

Question

我正在尝试使用ELK堆栈比较两个日志文件haproxy和nginx，尤其是logtash中的响应时间，我已经在logstash中为haproxy和nginx创建了两个单独的conf文件，在haproxy中，我获得了以毫秒为单位的响应时间，例如：2334和nginx我在几秒钟内得到它，例如：1.23我想以毫秒为单位转换nginx的响应时间，我尝试使用ruby文件转换它，但没有获得正确的结果，我还认为它与我为haproxy创建的当前elasticsearch索引冲突。

下面是我的两个配置文件：

Halogoxy logstash Conf：

input {
  beats {
    port => 5044
  }
 }

filter {
  grok {
    match => { "message" => "%{MONTH:month}  %{MONTHDAY:date} %{TIME:time} %{WORD:[source]} %{WORD:[app]}\[%{DATA:[class]}\]: %{IPORHOST:[UE_IP]}:%{NUMBER:[UE_Port]} %{IPORHOST:[NATTED_IP]}:%{NUMBER:[NATTED_Source_Port]} %{IPORHOST:[NATTED_IP]}:%{NUMBER:[NATTED_Destination_Port]} %{IPORHOST:[WAN_IP]}:%{NUMBER:[WAN_Port]} \[%{HAPROXYDATE:[accept_date]}\] %{NOTSPACE:[frontend_name]}~ %{NOTSPACE:[backend_name]} %{NOTSPACE:[ty_name]}/%{NUMBER:[response_time]:int} %{NUMBER:[http_status_code]} %{NUMBER:[response_bytes]:int} - - ---- %{NOTSPACE:[df]} %{NOTSPACE:[df]} %{DATA:[domain_name]} %{DATA:[cache_status]} %{DATA:[domain_name]} %{URIPATHPARAM:[content]} HTTP/%{NUMBER:[http_version]}" }
    add_tag => [ "response_time", "response_time" ]

  }
  date {
    match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
  }
 }

output {
  elasticsearch { hosts => ["localhost:9200"] }
#       stdout {
#               codec => rubydebug
#       }
  }

Nginx logstash conf文件

input {
  beats {
    port => 5045
  }
 }

filter {
 grok {
        match => { "message" => "%{IPORHOST:clientip} - - \[%{HTTPDATE:timestamp}\] \"%{WORD:verb} %{URIPATHPARAM:content} HTTP/%{NUMBER:httpversion}\" %{NUMBER:response} %{NUMBER:response_bytes:int} \"-\" \"%{GREEDYDATA:junk}\" %{NUMBER:response_time}"}
 }
       ruby {
               code => "event.set('response_time', event.get('response_time').to_i * 1000)"
       }
}
output {
 elasticsearch {
   hosts => ["localhost:9200"]
  }
 stdout { codec => rubydebug }
}

Answer 1

grok {
match => { "message" => "%{IPV4:clientip} - - [%{HTTPDATE:requesttimestamp}] "%{WORD:httpmethod} /" %{NUMBER:responsecode:int} %{NUMBER:responsesize:int} "-" "-" "-" "%{NUMBER:responsetimems:float}""}
}
ruby {
code => "event.set('responsetimems', event.get('responsetimems').to_i * 1000)"
}