Date filter failer

(Avi Haleva) #1

My Date filter fails although the string I'm trying to convert seems to match the matched pattern:

Some of the timestamp string have the following format : 2018-01-12 10:54:20,246
and some have the following : 2018-01-12 10:54:20.246

if the field was originally formed with comma (by the grok filter) the filter succeed but if the field contains period, it fails.

Below is the code that fails to parse the date getting back : _dateparsefailure
mutate {
gsub => [ "tmp_timestamp", ".", ","]

    date {
        match => [ "tmp_timestamp", "yyyy-MM-dd HH:mm:ss,SSS" ]
        remove_field => [ "tmp_timestamp" ]
        target => "log_timestamp"
        timezone => "%{timezone}"


I tried passing both format : match => [ "tmp_timestamp", "yyyy-MM-dd HH:mm:ss,SSS" , "yyyy-MM-dd HH:mm:ss.SSS" ]
with no luck, no matter what I did...

What am I missing ? What can be the filter fail cause that I'm missing ?

(Magnus B├Ąck) #2

The date filter will log a message in the Logstash log when it fails to parse a date.

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.