Custom timestamp

Elastic Stack Kibana
1

Hi guys. I would like kibana to use my timestamp which are in the logfiles fed from logstash.

My logstash conf looks like:

filter {
if [type] == "dibslog" {
grok {
match => { "message" => "%{DIBSLOG}" }
remove_field => [ "message" ]
}
mutate {
add_field => { "syslogtimestamp" => "%{month} %{day} %{time}" }
}
geoip {
source => "clientip"
target => "geoip"
database => "/etc/logstash/GeoLiteCity.dat"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
}
mutate {
remove_field => [ "month","day","time","host","offset","file"]
}
date {
match => [ "syslogtimestamp", "MMM dd HH:mm:ss", "MMM d HH:mm:ss" ]
}
}
}

And I actually have the field in Kibana with my syslogtimestamp - example: "Sep 13 13:01:07".

But during kibana's index pattern configuration, Kibana does not show syslogtimestamp on the list of time-fields...

I have added syslogtimestamp to the list of metaFields, but that didn't help.

2

What does the mapping for that field look like in ES?

3

It is a string, unfortunately...

4

Okay, it is actually working. I have just misunderstood how. It actually updates a different field, @timestamp, which render my own, syslogtimestamp, useless. Fine as it is.