Changing eventTime to ISO8601 standard

Elastic Stack Logstash
1

I am trying to change the eventTime to the ISO standard. I am looking at the filter date plugin but not sure how to code this in dissect. Any suggestions. thanks

dissect {
mapping => { "message" => '%{} %{} %{eventTime}:%{+eventTime}:%{} %{} %{}

2

What does a message look like?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.