I have Syslog timestamp from event parsed by logstash as : "syslog_timestamp" => "Jan 22 15:20:36"
How do I convert into timestamp / time format (instead of string) so that It can be searchable and I can apply time based query in Elasticsearch ?
I do this:
date {
target => "syslog_timestamp"
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
Still output is :
{
"syslog_timestamp" => "Jan 22 15:20:36",
"@timestamp" => "2016-01-22T23:20:36.000Z"
}