Date filter for CreatedDate

Elastic Stack Logstash
1

Hello I am trying to assign the CreatedDate as @timestamp for the records which are processed through logstash, Source of my input is Salesforce.

date {
match => ["CreatedDate", "yyyy-MM-dd'T'HH:mm:ss.SSSZ", "ISO8601"]
target => "@timestamp"
}

`

{"tags":["_dateparsefailure"],"@timestamp":"2019-01-21T22:41:36.988Z","Status":"New","CreatedDate":"2019-01-07T20:06:06.000Z"}

`

2 
match => ["CreatedDate", "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"]
3

I used all the below combinations but still getting the dateparsefailure

["yyyy-MM-dd'T'HH:mm:ss.000'Z'","yyyy-MM-dd'T'HH:mm:ss.SSS'Z'","yyyy-MM-dd'T'HH:mm:ss.SSSZ"]

4

Not sure what to say. This configuration works just fine for me...

input { generator { count => 1 message => '{"CreatedDate":"2019-01-07T20:06:06.000Z" }' } }
filter {
    json { source => "message" }
    date { match => ["CreatedDate", "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'"] timezone => "Pacific/Guam" }
}
output { stdout { codec => rubydebug } }

produces

 "@timestamp" => 2019-01-07T10:06:06.000Z,
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.