Assume the date is current date if there is no date in log

I have log:
08:42:21.706 [qtp1335954408-120] DEBUG i.s.client.http.JestHttpClient - POST method created based

It contains just time I need to add month and day . How can i do it with logstash filters?

You'll have to use a ruby filter for this. Use Ruby's standard date and time functions to add the date in the field where you currently have the time

Can you please provide some example?

What part are you having trouble with, specifically? There are plenty of ruby filter examples out there.

I have grok filter to parse this log

if [type] == "neo4j" {
grok {
match => [
"message", "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:severity} %{GREEDYDATA:message}",
"message", "%{TIME:timestamp} %{SYSLOG5424SD:data} %{LOGLEVEL:severity} %{GREEDYDATA:message}" ]
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]

but I got only time (because log has only time) How I can add day and month here?
thanks for reply magnusbaeck

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.