logstash filter 字符串转换为json

filter {
	
	# 去除\n 和空值[字符串可能存在空值、\n等特殊字符]
	mutate {
         strip => ["message"]
    }
	
	# 转为json 并赋值给 target 
	json {
		source => "message"
		target => "message2"
	}
	
	# json 添加字段
	mutate{
		add_field => {"[message2][@timestamp]"=> "%{+YYYY-MM-dd HH:mm:ss}"}	
	}
	
	mutate{
		remove_field  => "message"
	}
	
	# 字段重命名
	mutate{
		rename => { "message2" => "message" }
	}
	
	# 转换@timestamp字段为时间戳，赋值给字段 [message][@timestamp]
	ruby{
		code => "event.set('[message][@timestamp]',(event.get('@timestamp').to_f.round(3)*1000).to_i)"
	}
  
}