logstash 將兩個字段合併爲一個字段的方法

假設message中含有[01/14/2020][18:35:46]，想要把這兩個拼接爲一個日期字段，需要使用mutate插件：

grok{
    match => {
        "message" => "\[%{GREEDYDATA:yearmonthday}\]\[%{GREEDYDATA:time}\]"
    }
}
mutate{
    add_field => {"timestamp" => "%{yearmonthday} %{time}"}
}
date{
    match => ["timestamp", "MM/dd/yyyy HH:mm:ss"]
    target => "@timestamp"
    remove_field => ["timestamp","yearmonthday","time"]
}

這樣到es中就會只剩下@timestamp這一個含有年月日時分秒的字段。