Date filter ISO 8601

I'm doing something which I thought should be simple.. but can't get it to work for the life of me.. I'm doing a jdbc query.. and my data has a sampletime in the record that I want to use the the timestamp.. this is what I've in .conf

I've tried all the formatting options including, "yyyy-MM-dd'T'HH:mm:ss.SSSZ"

filter {
date {
match => [ "sampletime", "ISO8601" ]
target => "@timestamp"

this what I'm getting back.. when I output it..

"sampletime" => 2018-08-14T15:14:44.000Z,
"@timestamp" => 2018-08-14T15:18:02.392Z

If that is the output of stdout { codec => rubydebug } then given that sampletime is not surrounded by quotes, it is already a date. And date cannot parse a date. Use mutate+convert to make sampletime a string and then the ISO8601 shorthand should work.

OK.. that's the ticket

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.