Date Filter not working, not even Indexing with _dateparsfailure tag


(Sayantan Dey) #1

I have one field named event-reporting-time which has a string like this: "Mar 27 2018 02:32:10 AM -07:00", I have used the following filter :
date {
match => [ "event-reporting-time", "MMM dd yyyy KK:mm:ss aa ZZ", "MMM dd yyyy K:mm:ss aa ZZ"]
}

It doesn't work and doesn't even output with _dateparsefailure tag.

i further tested removing the trailing ZZ from the match, and it indexes data with _dateparsefailure tag.

Then I deleted -07:00 from the date and with the ZZ already removed, again no indexing happens. Any clue whats going on?


#2

How do you know it is not indexed? In Kibana, does the time range you are viewing include the morning of March 27th? When I pass that string to that date filter it successfully sets @timestamp to 2018-03-27T09:32:10.000Z


(Sayantan Dey) #3

Well, the index I'm creating doesn't get created.


(Sayantan Dey) #4

OMFG! You're right!!
This whole time whenever I was thinking is not indexing, it was actually indexing at the earlier date!! Thanks a lot!


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.