I have one field named event-reporting-time which has a string like this: "Mar 27 2018 02:32:10 AM -07:00", I have used the following filter :
match => [ "event-reporting-time", "MMM dd yyyy KK:mm:ss aa ZZ", "MMM dd yyyy K:mm:ss aa ZZ"]
It doesn't work and doesn't even output with _dateparsefailure tag.
i further tested removing the trailing ZZ from the match, and it indexes data with _dateparsefailure tag.
Then I deleted -07:00 from the date and with the ZZ already removed, again no indexing happens. Any clue whats going on?