I have the following input date , time string as input:
Date == 03OCT17
Hour == 20
Minute == 45
These 3 fields are combined into a single string. "03OCT17:20:45". where the timezone is
mutate {
add_field => { "timestamp" => "%{Obs Date}:%{Obs Hour}:45" }
}
The date generated by mutate above is parsed as shown below:
date {
match => [ "timestamp", "ddMMMyy:HH:m" ]
target => "@timestamp"
}
Therefore , input string as seen by date parser is:
"timestamp" => "03OCT17:20:45",
Output result is :
"@timestamp" => 2017-10-04T00:45:00.000Z,
"1) Why is the day wrong in the "@timestamp" . It is shown as 04 instead of 03.
2) Why is the hour wrong in the "@timestamp". It is shown as T00 instead of T20
I have tried this using timezone of -5:00 and still don't get the right day/hour.
There is no dateparseerror output.