我正在使用logstash管道将数据接收到rsyslog服务器。

但管道正在开始添加额外的日期戳和%{host

示例：

**Sep 22 04:47:20 %{host}  2022-09-22T04:47:20.876Z %{host}**22-09-2022 05:47:20.875 a7bd0ebd9101-SLOT0   `TEST-AWS-ACTIVITY`#011970507     P        201059147698 `[FCH-TEST] [35.49.122.49] [TEST-251047********-******] [c713fcf9-6e73-4627-ace9-170e6c72fac5] OUT;P;201059147698;;;;/bcl/test/survey/checkSurveyEligibility.json;ErrorMsg=none;;{"body":{"eligible":false,"surveys":[]},"header":null}`**

有没有人知道这个额外的部分是从哪里来的，以及如何抑制它。

数据来自安装在ECS容器上的AWS CloudWatch。

管道配置为：

input  { pipeline { address => test_syslog } }

filter {

if [owner] == "1638134254521"  { 
   mutate { add_field  =>  { "[ec_part]" => "AWS_TEST"} }

  } 
}

output {

# TEST ACTIVITY Logs being sent via TCP to Logreceiver

  if [ec_part] == "AWS_TEST" {
  syslog {
    appname => ""
    host => "10.119.140.206"
    port => "10514"
    protocol => "ssl-tcp"
    ssl_cacert => "/etc/logstash/ca.crt"
    ssl_cert => "/etc/logstash/server.crt"
    ssl_key => "/etc/logstash/server.key"
    priority => "info"
    rfc => "rfc5424"
  }
  }
}