logstash 将两个字段合并为一个字段的方法

假设message中含有[01/14/2020][18:35:46]，想要把这两个拼接为一个日期字段，需要使用mutate插件：grok{match => {"message" => "\[%{GREEDYDATA:yearmonthday}\]\[%{GREEDYDATA:time}\]"}
}
mutate{add_field => {"timestamp" => "%{yearmonthday} %{time}"}
}
date{match => ["timestamp", "MM/dd/yyyy HH:mm:ss"]target => "@timestamp"remove_field => ["timestamp","yearmonthday","time"]
}这样到es中就会只剩下@timestamp这一个含有年月日时分秒的字段。