Convert Date String Into Date Format

Elastic Stack Logstash
82

Date,MobileNo,Msg,ServiceId,SMS,wsResponse,AKNMsgId,MMMsgId,AmountCharged
4/30/2019 23:54,923459797512,NEWS,4080,"Moaziz Sarif, Ap ko News bundle k liye subscribe kia ja chuka hai @Rs13.15 incl of tax/month. Agar ap is service ko unsubscribe karna chahty hain tu 3453461# dial kijye.",1,15941612,0,11

This is one record for testing

83

789 create the date format 789 is the index i created on run time can we do this that we create index and then load the data with the same index can the data parse into the same index ??

84

What should i do then to convert the date format string into data type data you have my config file in the above post and now you have 1 record for testing can you check on your elastic and share the output for me. Really appreciate it !!

85

can we have a session through any desk or team viewer ??

86

output of rubydebug

image
image.png1366×768 63.7 KB

87

At least for the date parse failure, the format in your screenshot is: M/dd/yyyy HH:mm
So:

date {
  match => ["Date", "M/dd/yyyy HH:mm"]
  target => "Date"
}

See: https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-match

1 Like
88

the last screenshot i uploaded i use this date format
date {
match => [ "Date", "ISO8601", "YYYY-MM-dd HH:mm:ss", "YYYY-MM-dd HH:mm:ss.ZZZ" ]
target => "Date"
locale => "en"
}

89

ok i will try this format also

90

Thank a tons it woks date is converted in date format !! :slight_smile:

91

image
image.png1366×768 97.9 KB

92

Thank you everyone for helping me out specially thanks to @dgonzalezp

1 Like
93

Finally its solved! I was close, the problem was the format in the match section, thank you to @admlko for that
was a pleasure @Syed.Ubaid :slight_smile:

94

@admlko @dgonzalezp if there is another config file i should check the date format in which format date is coming then write the same pattern in my config
??

95

image
image.png1366×768 78.4 KB
if you see the screenshot the the message column start with date format which is mention by @admlko while in the date column date is scoming in YYYY:MM:DD .
So if there is another config file i should check the date format and then write config file according to it

96

If the date format varies between events, you can define multiple formats. The format in the screenshot is ISO8601, so:

match => ["Date", "M/dd/yyyy HH:mm", “ISO8601”]

Should work for these two formats.

EDIT: although I don’t see where the Date field comes in that event. The message field has the same format.

97

2019-05-13 00:00:06.687

what to do for this format

98

and also for this format 4/30/2019 1:35:16

99

for this format 4/30/2019 1:35:16
i use
date {
match => ["Date", "M/dd/yyyy HH:mm:ss"]
target => "Date"
}
but it still remain in the string datatype

100

@admlko please help

101

2019-05-13 00:00:06.687

yyyy-MM-dd HH:mm:ss.SSS

4/30/2019 1:35:16

M/dd/yyyy H:mm:ss

I have already provided you with a link to the documentation where this is clearly explained.

@admlko please help

Next time someone pings me, I expect that they want to buy consultation from me. If that is the case, you are very welcome.
If not, I do this for fun on my free time. If I have some, I will drop by here (and also on other forums) and help others and learn. But please do not expect that this would be my job :slight_smile:

1 Like