Trying to parse some zookeeper logs as below but no matter the month in the timestamp it is always set to 01 and never gets ingested.
##Sample simulate.
{
"docs": [
{
"_index": "filebeat-7.7.0-2020-06.08",
"_id": "id",
"_source": {
"message": "2020-06-08 16:27:05,962 [myid:5] - INFO [NIOServerCxn.Factory:0.0.0.0/0.0.0.0:2181:NIOServerCnxn@1056] - Closed socket connection for client /10.0.0.1:48520 (no session established for client)"
}
}
]
}
##Date filter i'm using.
{
"date" : {
"field" : "timestamp",
"target_field" : "@timestamp",
"ignore_failure": true,
"formats" : [
"yyyy-MM-DD HH:mm:ss,SSS"
],
"on_failure" : [
{
"append" : {
"field" : "error.message",
"value" : "{{ _ingest.on_failure_message }}"
}
}
]
}
},
{
"remove" : {
"field" : "timestamp"
}
}
],
##Output showing the month as 01 when it should be 06.
{
"docs" : [
{
"doc" : {
"_index" : "filebeat-7.7.0-2020-06.08",
"_type" : "_doc",
"_id" : "id",
"_source" : {
"metadata" : "NIOServerCxn.Factory:0.0.0.0/0.0.0.0:2181:NIOServerCnxn@1056",
"@timestamp" : "2020-01-08T16:27:05.962Z",
"myid" : "5",
"level" : "INFO",
"program" : "zookeeper",
"message" : "Closed socket connection for client /10.0.0.1:48520 (no session established for client)"
},
"_ingest" : {
"timestamp" : "2020-06-08T20:53:38.277911Z"
}
}
}
]
}