Cannot get date to match timestamp after xml parsing

Elastic Stack Logstash
1

here is the xml field that comes in originally (xml parsing works fine, and this field shows up in kibana as entry.Timestamp):
2016-04-04T17:45:34.498-04:00

here is what the json looks like after xml parsing:
"entry": {
"Timestamp": ["2016-04-04T17:45:34.498-04:00"]
}

i have tried the following in the date filter:
match => [ "entry.Timestamp", "YYYY-MM-dd HH:mm:ss,SSSZ", "ISO8601" ]
match => [ "Timestamp", "YYYY-MM-dd HH:mm:ss,SSSZ", "ISO8601" ]

no matter what i do I cannot get @timestamp to pull this time. I tried adding
"YYYY-MM-dd'T'HH:mm:ss,SSSZ"
but that resulted in errors. there are no errors and no logs to why it doesn't match.

config currently looks like after trying to match "Timestamp" as well as "entryTimestamp":
if "myFirstDate" in [type]{
xml {
target => entry
source => message
}
date{
match => [ "entry.Timestamp", "YYYY-MM-dd HH:mm:ss,SSSZ", "ISO8601", "UNIX_MS", "UNIX", "MMMM d YYYY, HH:mm:ss.SSS", "MMMM dd YYYY, HH:mm:ss.SSS" ]
add_tag => [ "dated" ]
}

Any help is appreciated.

2

The correct syntax for referring to nested fields isn't entry.Timestamp. See https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references.

3

indeed that would be my issue. This is my first time dealing with nested fields and i had no idea how to consume them. For those other newbs to nested fields, this is how i handled it:

match => [ "[entry][Timestamp]", "YYYY-MM-dd HH:mm:ss,SSSZ", "ISO8601" ]

and voila, disco.

Thanks magnus.