Changing timestamp

Elastic Stack Logstash
1

Hello!
I would like to know how could I chage the timestamp in my logs, I'm receiving logs with a previous timestamp included and I would like to put this value as the timestamp.
For example>
"2014/09/22 14:20:08.799 [old_tags_app] [ANT]"
Inside the log message appears the timestamp I want to use in my database. In this case last year 22-09.
The problem is that I have been changing the configuration in the filter with "date{...} " but I always obtain a dateparsefailure. and the "@timestamp" in Kibana with the value of time of the arrival instead of the value inside the message.

Thank you

2

Using the date filter is the correct solution. What have you tried so far?

3 
  date{
                                        match => [ "date", "YYYY/MM/DD HH:mm:ss.SSS" ]
                                        target => "@timestamp"
                                        }

I have to put the format of my date in the log in the match, isn't it?

In the pattern file I have this:

DATE %{YEAR}[/]%{MONTHNUM}[/]%{MONTHDAY}[ ]%{TIME}



MESSAGE_1 (?m)%{DATE:date} \[%{APPNAME:app}].....
4

And what's in the date field that you're asking the date filter to parse?

You're missing a backslash before "]" in the MESSAGE_1 pattern.

5

"date" is the Tag where it's stored the information of the date I want to use for the timestamp with the format I have specified in the pattern file.

I have noticed that the poblem is in Kibana, it appears at January 22nd 2014, 14:20:08.799 when I send 2014/09/22 14:20:08.799 [old_logs_app].... How could it be?

6

"date" is the Tag where it's stored the information of the date I want to use for the timestamp with the format I have specified in the pattern file.

Yes, but what's the contents of the field for an example line of input? Before debugging the date filter's configuration, let's make sure the input is correct.

I have noticed that the poblem is in Kibana, it appears at January 22nd 2014, 14:20:08.799 when I send 2014/09/22 14:20:08.799 [old_logs_app].... How could it be?

Oh. Your date pattern is YYYY/MM/DD but is should be YYYY/MM/dd.

7

Solved!! it was YYYY/MM/dd.
Thank you very much Magnus!