Date filter not parsing this datetime

Elastic Stack Logstash
1

It seems like this should work, but I'm getting a parsing error.

Sample: 07/08/16-09:25:42.140797
date {
match => [ "datetime", "MM/dd/yy-HH:mm:ss.SSS" ]
}

What might I be doing wrong or how can I debug the error?

Thanks for the help!

2

The error message you get,

Failed parsing date from field {:field=>"datetime", :value=>"07/08/16-09:25:42.140797", :exception=>"Invalid format: "07/08/16-09:25:42.140797" is malformed at "797"", :config_parsers=>"MM/dd/yy-HH:mm:ss.SSS", :config_locale=>"default=en_US", :level=>:warn}

hints at what the problem is. Use SSSSSS instead of SSS (but keep in mind that Elasticsearch only keep millisecond resolution, and so will Logstash).

3

Yep, that seems to be what the deal is. I thought that is would just zero out the remaining timing, but obviously I was wrong. Thanks!