Date filter configuration error

Elastic Stack Logstash
#1

HI Guys,

I am trying to replace @timestamp with tstamp but it is not working. What am I missing here? Here is my configuration

     date {
            match => ["tstamp","yyyy-MM-dd'T'HH:mm:ss.SSSZ"]
            target => "@timestamp"
    }

and the sample date entry is like this

2016-04-02T09:29:50.348Z
2016-04-02T08:52:49Z
2016-04-02T02:52:50.000Z

#2

You should be able to use the special ISO8601 pattern. The problem with your current pattern might be that the "Z" Joda-Time pattern can't parse the "Z" in the string. If the timezone is always "Z" you should be able to treat it like a literal and single-quote the "Z" in the pattern.

#3

Thanks @magnusbaeck, it is working fine. But what if I want to replace timestamp with a array field. Will it work like this

date {
match => ["[a].[b]","ISO8601"]
target => "@timestamp"
}

#4

See https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references for the syntax for nested fields.

#5