Convert text field to date in ingest pipeline

[KentLee (Ken Lee)]

Hi,
I am creating a ingest pipeline to ingest application log to elastic and I have the log line format as follow:
[2023-05-03 16:12:19,420] - [Application Name] - [INFO] - Log details goes here

Based on this format I created an ingest pipeline with grok processor:
\[%{TIMESTAMP_ISO8601:log.timestamp}\] - \[%{DATA:log.appName}\] - \[%{DATA:log.level}\] %{GREEDYDATA:log.message}.

It's working fine. However, I wanted to convert the field log.timestamp (which is a text field) to date, and the date processor shows "error"

[Priscilla_Parodi]

Hello KentLee,

Probably because the text field containing log dates 2023-05-03 16:12:19,420 does not match the date format ["yyyy-MM-dd HH:mm:ss.SSS"]

Try to use this yyyy-MM-dd HH:mm:ss,SSS in the Formats.

Hope it helps.

[KentLee (Ken Lee)]

@Priscilla_Parodi

yyyy-MM-dd HH:mm:ss,SSS

Thank you, it works.