Date filter dateparsefailure

Elastic Stack Logstash
1

Hello...
I've been experimenting with logstash capabilities lately, and no matter which direction I take with the date filter, I seem to end up with _dateparsefailure. So to save myself the frustration, I was wondering if anyone could identify what is wrong, second set of eyes :slight_smile: .

I am reading from dated logs. therefore my goal was to set @timestamp to the time within the log as opposed to the log insertion time.

Here is a sample date i'm working with: "2020-01-01 18:12:09.746046"
This date is set to a field named "Logdate" using grok before the date filter is called in the config.

and here is the snippet of my config:

date {
locale => "en"
match => ["Logdate", "yyyy-MM-dd HH:mm:ss.SSS"]
target => "@timestamp"
}

Any input would be appreciated!

2

You have to match the entire field, so if you have six digits of precision use

match => ["Logdate", "yyyy-MM-dd HH:mm:ss.SSSSSS"]
2 Likes
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.