Hi all,
I 'm using logstash 6.0 version, unable to overwrite @timestamp using date filter.
Below sample logs are
2017-12-11 01:04:56,195 INFO XXXYXYYXYXYXY
2017-12-11 01:04:56,239 ERR XYEUUSSI
Configurations are
cat /etc/logstash/conf.d/patterns
JBOSS_TIME_FORMAT %{YEAR}[/-]%{MONTHNUM}[/-]%{MONTHDAY} %{TIME}
cat jboss.conf
filter {
grok {
patterns_dir => ["/etc/logstash/conf.d/patterns"]
match => [
"message", "%{JBOSS_TIME_FORMAT:Log_Time} %{LOGLEVEL:Log_level} %{GREEDYDATA:LOG_MESSAGE}"
]
}
date {
match => [ "Log_Time","yyyy-MM-dd HH:mm:ss,SSS" ]
}
}
@Timestamp is not overwriting by date filter, Please help to debug on this.
Thanks in advance