Best way to handle different date formats?


(Sjaak) #1

Hi,

I have a a bunch of .csv files but the providing party has been nice enough to use a different date format on just about every file...

Apart from using lots of if statements, is there a more practical way to have the date filter apply the date in the .csv as @timestamp?

The date format varies between yyyy/mm/dd hh:mm:ss, dd/mm/yyyy hh:mm:dd, d/mm/yyyy h:mm:ss am/pm etc.


(Philip Nunn) #2

The "match" option on the date filter Logstash plugin takes an array input. This means you could have multiple date patterns with just one date filter in your config file. There are examples of this in the logstash documentation here.


(Sjaak) #3

Thanks. Complete read over the fact match functions as an array.