Date filter for minor changes in format

#1

Mar 3, 2019 9:40:30,734 PM
Mar 11, 2019 11:20:10,114 PM

I have to parse logs with the following formats. The first date does not have a 0 in front of the 3. This also applies to the hours portion. I am unsure how I would use the date filter for both formats.

This is my current date config. Will it have trouble reading from days and hours in the single digits?

date {
      match => ["logdate", "MMM dd, YYYY KK:mm:ss,SSS a"]
      target => "logdate"
    }
#2

When the day is a single digit is there one space or two between it and the month?Similarly for the hour.

#3

Just one space

#4

OK, then "MMM dd, YYYY KK:mm:ss,SSS a" will parse both.

#5

Was recently able to try this. Was unable to select "logdate" as my timestamp when I was creating the kibana index. I assume its unable to recognize logdate as an actual date stamp.

#6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.