logstash配置，在某个时间段，加tags，比如只在此时间段内才记录全量日志

logstash.conf

input {
  generator {
    lines => [
      "line 1",
      "line a"
    ]
    count => 1
  }
}

filter {
  grok { match => [ "message", "^line \d$" ] }

  ruby {
    init => "require 'time'"
    code => "
      current_time = Time.now
      start_time   = Time.parse('09:20')
      end_time     = Time.parse('09:50')
      if current_time >= start_time && current_time <= end_time  
        event.tag('logall')
      else
        event.tag('lognotall')
      end
    "
  }
  
}

output { stdout { codec => rubydebug } }