Date filter not working - Logstash

Elastic Stack Logstash
1

I am trying to use following date filter to convert string to date but it doesn't seem to be working.

Sample input data(string) - Jan 20 09:20:35 GMT 2020

I am first using a mutate gsub to remove GMT which renders following string output-
Jan 20 09:20:35 2020

My gsub mutate filter looks like this -

mutate { gsub => [ "TimeStamp", "GMT", "" ] }

Now, I am using a date filter to convert gsub output to date format but it doesn't seem to be working-

date {
match => [ "TimeStamp", "EEE MMM dd HH:mm:ss yyyy" ]
target => "TimeStamp"
locale => "en"
}

I have also tried following with no success-

date {
match => [ "TimeStamp", "EEE\sMMM\sdd\sHH:mm:ss\s+yyyy" ]
target => "TimeStamp"
timezone => "Etc/GMT"
locale => "en"
}

2

If you do not have a space in the mutate that removes the GMT then you will have two spaces in the field and will need two spaces in the date filter.

3

Thanks for your reply. I actually have 2 spaces in filter. The space was removed while pasting here.

4

Your example data does not contain the day of the week, but your pattern has EEE.

5

Sorry there was a typo in in the original date string I posted. It indeed has a weekday. It actually looks like Mon Jan 20 09:20:35 GMT 2020

6

What value do you end up with in the [TimeStamp] field?

1 Like
7

Jan 20 09:20:35 2020

Basically the same value that comes as the output from the gsub filter. (2 spaces between :35 and 2020)

Note: The extra space is getting removed when I try to post my comment here.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.