Change timestamp in logstash input

[zerratriani]

Hi, I have a log like this and want to change the timestamp to the time in the log.

Example Log

event1: aaaaaaa | event2: xxxxxxx | event3: ccccccc | date : 2022-11-07T21:03:48.9110;

The logstash

input {
  file {
    path => "D:/dump/*.log"
    start_position => "beginning"
    mode => "read"
    file_completed_action => "delete"
    sincedb_path => "NUL"
  }
}

filter {
    grok {
	  break_on_match => false
	  match => { "rawMessage" => [
			      "(?<Event1>(event1:)([^|]*))",
				  "(?<Event2>(event2:)([^|]*))",
				  "(?<Event3>(event3:)([^|]*))",
				  "(?<date>(date.:)([^;]*))"] }
    }

   date {
			match => "%{date}"
			target => "@timestamp" 
		}
}

output {
		elasticsearch { 
			hosts => ["localhost:9200"]
			index => "event_test"
		}
}

[Rios]

Try with this:

	 date {
      match => [ "date", "ISO8601" ]
	  target=> "@timestamp"
	 }

PS. Since this is separated with |, you can use csv or dissect filters.

[zerratriani]

@Rios

date {
      match => [ "date", "ISO8601" ]
	  target=> "@timestamp"
	 }

It still gives results like the following. Log stays in time when sent.

[Rios]

Your grok is not OK. The date field has value:

{
  "date": [
    [
      "date : 2022-11-07T21:03:48.9110"
    ]
  ]

Try something like this:

grok {
	  match => { "rawMessage"  => "event1: %{DATA:event1} \| event2: %{DATA:event2} \| event3: %{DATA:event3} \| date : %{DATA:date};"
}
	 date {
      match => [ "date", "ISO8601" ]
	  target=> "@timestamp"
	 }

[zerratriani]

It works now then how do I change the timezone in my area? Because it's still using global time. Thank you

[Rios]

Time zones are here
ES and LS are based on UTC. Bu default, Kibana show data based on browser TimeZone.

  date {
      match => [ "date", "ISO8601" ]
      timezone => "Asia/Bangkok"
      target=> "@timestamp"
  }

[zerratriani]

Hi, i have problem with date filter, i run it on windows and it's work perfectly. But when i try in linux environtment it's doesn't work. And doesn't send any data to elastic. Please help

[Rios]

Can you dump data from ruby debug on Linux? Put as text, not as pic.

[zerratriani]

it's working now i change

match => [ "date", "ISO8601" ]
to
match => [ "date", "yyyy-MM-dd'T'HH:mm:ss.SSSS" ]