Assume the date is current date if there is no date in log

Elastic Stack Logstash
1

I have log:
08:42:21.706 [qtp1335954408-120] DEBUG i.s.client.http.JestHttpClient - POST method created based

It contains just time I need to add month and day . How can i do it with logstash filters?

2

You'll have to use a ruby filter for this. Use Ruby's standard date and time functions to add the date in the field where you currently have the time

3

Can you please provide some example?

4

What part are you having trouble with, specifically? There are plenty of ruby filter examples out there.

5

I have grok filter to parse this log

if [type] == "neo4j" {
grok {
match => [
"message", "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:severity} %{GREEDYDATA:message}",
"message", "%{TIME:timestamp} %{SYSLOG5424SD:data} %{LOGLEVEL:severity} %{GREEDYDATA:message}" ]
}
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
}

but I got only time (because log has only time) How I can add day and month here?
thanks for reply magnusbaeck

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.