Hi,
My Date filter fails although the string I'm trying to convert seems to match the matched pattern:
Some of the timestamp string have the following format : 2018-01-12 10:54:20,246
and some have the following : 2018-01-12 10:54:20.246
if the field was originally formed with comma (by the grok filter) the filter succeed but if the field contains period, it fails.
Below is the code that fails to parse the date getting back : _dateparsefailure
...
mutate {
gsub => [ "tmp_timestamp", ".", ","]
}
date {
match => [ "tmp_timestamp", "yyyy-MM-dd HH:mm:ss,SSS" ]
remove_field => [ "tmp_timestamp" ]
target => "log_timestamp"
timezone => "%{timezone}"
}
...
I tried passing both format : match => [ "tmp_timestamp", "yyyy-MM-dd HH:mm:ss,SSS" , "yyyy-MM-dd HH:mm:ss.SSS" ]
with no luck, no matter what I did...
What am I missing ? What can be the filter fail cause that I'm missing ?
Thanks,