Try using date_time:
convert => { "Date" => "date_time" }
data is parse but still showing date format into string not in date
You are refreshing the fields, right?
Is weird because if the data is parse should work...
parse the data then refreshing the field
i also create a new index but the result still the same
Well lets try this:
filter {
csv {
separator => ","
columns => ["Date","MobileNo","Msg","ServiceId","SMS","wsResponse","AKNMsgId","MMMsgId","AmountCharged"]
}
date {
match => ["Date", "MM/DD/YYYY HH:mm"]
target => "Date"
}
}
data is parse but still date filed datatype showing string not date.
Please check the attached screenshot
date {
match => ["Date", "MM/DD/YYYY HH:mm"]
target => "Date"
}
}
If you see the result in the above screenshot date is showing 2019-01-30 while we give the date format is MM/DD/HH:mm
Did you create a new index again (as we can not change the mapping of the existing field once it has already been mapped as text) ?
Yes everytime i create a new index but the problem still remains the same...
What if we give the same format?
YYYY-MM-DDTHH:MM:SS.SSSSZ
My next two steps would be:
- Have a look at the rubydebug output to make sure you have a Timestamp object in Logstash.
- If it is a Timestamp, but the dynamic mapping doesn't detect it as a date datatype, create the mapping/a mapping template manually and define that field as a date.
1 Like
YYYY-MM-DDTHH:MM:SS.SSSSZ it gives error on this format
@Jenni if you see the screenshot when the data is parse logstash make by default timestamp @ date format but what i need to do is date format which is by default is string i have to make this column into date format.
create the mapping/a mapping template manually and define that field as a date.
Can you please mention the code because i am new into ELK Stack.
https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-templates.html
Try something like this and see if the index gets created correctly.
PUT _template/your_template
{
"index_patterns": ["whateveryourindexnamestartswith*"],
"mappings": {
"properties": {
"Date": {
"type": "date"
}
}
}
}
Edit: But you said you have some kind of template. What does it look like?
You typed PPUT
That means that works, check the field Date.