Having problems updating the @timestamp value for my messages. Would appreciate any insight into what might be going wrong here.
Sample log line:-
2015-11-24 11:44:55,888 INFO [com.blandio.ct.avd.dao.CSDAO: 238] - Disconnect received.
My date filter looks like:
filter {
grok {
match => ["message","(?<tstamp>\d{4}\-\d{2}\-\d{2}\s\d{2}\:\d{2}\:\d{2}\,\d{3})"]
}
date {
match => [ "%{tstamp}","yyyy-MM-dd HH:mm:ss,SSS" ]
}
}
so in this case I am capturing the timestamp with a grok and then using the field the grok creates as the value for date to match against. This fails as tthe @timestamp value is just the logstash parse time not the log event time.
I have tried without the initial grok - just the same. I have tried using lowercase "mm" for the month - just the same.
I have tried using locale and target parameters to update an existing field - just the same.
Would appreciate any help as to why this is failing.
Many thanks.