logstash 配置，目录切分，时区问题。
```
<encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
<providers>
<timestamp>
<timeZone>UTC</timeZone>
</timestamp>
<pattern>
<pattern>
{
"severity": "%level",
"service": "${springAppName:-}",
"trace": "%X{X-B3-TraceId:-}",
"span": "%X{X-B3-SpanId:-}",
"parent": "%X{X-B3-ParentSpanId:-}",
"exportable": "%X{X-Span-Export:-}",
"pid": "${PID:-}",
"thread": "%thread",
"class": "%logger{40}",
"rest": "%message",
"throwable": "%xEx"
}
</pattern>
</pattern>
</providers>
</encoder>
```
````
input {
tcp {
port => xxx
codec => json_lines
}
}
filter {
ruby {
#code => "event.timestamp.time.localtime"
code => "event.set('@timestamp', LogStash::Timestamp.coerce(event.get('@timestamp').time.localtime + 8*60*60))"
}
}
output {
file {
path => "/home/logs/logstash/%{service}/log-%{+YYYY-MM-dd}.log"
}
}
````
{service} 对应logback.xml中pattern.service值