Converting Date-String into Date with Ingest-pipeline not working

Elastic Stack Elasticsearch
1

We have this pipeline:

PUT _ingest/pipeline/j2-e2a-test
{
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": [
          "(?m)(?<myfulldate>%{DATE_EU}\\s+%{TIME})\\s+(%{WORD:loglevel}\\s+)\\s+(?<Correl_id>([\\h]{8}-[\\h]{4}-[\\h]{4}-[\\h]{4}-[\\h]{12}))\\s+\\[(?<Thread_ID>[0-9]{1,2})\\]\\s+(?<Function>\\((.*?)\\))\\s+?%{GREEDYDATA:message}"
        ]
      }
    },
    {
      "date":{
        "field": "myfulldate",
        "formats": ["dd.MM.yyyy HH:mm:ss.SSS"],
        "target_field": "@timestamp",
        "ignore_failure": true,
        "timezone": "Europe/Berlin"
      }
    }
  ]
}

this message:


20.06.2021 04:13:18.492 INFO    2e49acf6-3f65-4c4e-bcdf-354435c83648 [9] (Storage.StorageStaticFactory.Create) (?.?) Es ist kein Anbieter für einen externen Speicher '' hinterlegt

We have the problem, that our datetime, is not converting to the @timestamp.

2

Welcome!

It would help if you could provide a full recreation script as described in About the Elasticsearch category. It will help to better understand what you are doing. Please, try to keep the example as simple as possible.

A full reproduction script is something anyone can copy and paste in Kibana dev console, click on the run button to reproduce your use case. It will help readers to understand, reproduce and if needed fix your problem. It will also most likely help to get a faster answer.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.