I am trying to parse e csv. All works fine except for date field.
This is the format: 2020-02-21 18:25:37.254774
and this is my date code:
date { match => ["date", "yyyy-MM-dd HH:mm:ss.SSS"] target => "@timestamp" }
This is full csv line:
csvlog "2020-02-21 18:25:37.254774" srv1 10.10.100.1 48619 192.168.25.50 57027 TCP
This is full logstash conf:
input {
file {
path => "/var/log/csv.log"
start_position => "beginning"
}
}
filter {
csv {
columns => [
"event.module",
"date",
"agent.hostname",
"source.ip",
"source.port",
"destination.ip",
"destination.port",
"network.transport"
]
add_tag => [ "%{event.module}" ]
add_field => {
"destination.address" => "%{destination.ip}"
"source.address" => "%{source.ip}"
}
separator => " "
remove_field => ["message"]
}
date {
match => ["date", "yyyy-MM-dd HH:mm:ss.SSS"]
target => "@timestamp"
}
}