Date filter ISO 8601

[Ken_Leoni (Ken)]

I'm doing something which I thought should be simple.. but can't get it to work for the life of me.. I'm doing a jdbc query.. and my data has a sampletime in the record that I want to use the the timestamp.. this is what I've in .conf

I've tried all the formatting options including, "yyyy-MM-dd'T'HH:mm:ss.SSSZ"

filter {
date {
match => [ "sampletime", "ISO8601" ]
target => "@timestamp"
}
}

this what I'm getting back.. when I output it..

"sampletime" => 2018-08-14T15:14:44.000Z,
"@timestamp" => 2018-08-14T15:18:02.392Z

[Badger]

If that is the output of stdout { codec => rubydebug } then given that sampletime is not surrounded by quotes, it is already a date. And date cannot parse a date. Use mutate+convert to make sampletime a string and then the ISO8601 shorthand should work.

[Ken_Leoni (Ken)]

OK.. that's the ticket