Date filter plugin error

The date filter plugin is incorrectly overwriting the month of my date with January, see example output below and configuration.

Logstash Conf File

input {
  stdin {}
}

filter {

            date {
                target => "event.start"
                match => [
                    "message",
                    "yyyy-MM-DD HH:mm:ss Z"
                ]
            }

}

output {
  stdout {}
}

Output of logstash parser:

2020-08-01 12:54:12 +1000
{
        "message" => "2020-08-01 12:54:12 +1000",
     "@timestamp" => 2020-06-23T04:00:34.098Z,
           "host" => "prd03-lss02.prd03.ops.omss",
    "event.start" => 2020-01-01T02:54:12.000Z,
       "@version" => "1"
}

Note with an input of 2020-08-01 12:54:12 +1000 I would expect event.start to be 2020-08-01T02:54:12.000Z, however the month is replaced with 01. It doesn't matter what value goes in for month it just gets overwritten by the date filter with 01. This is not expected behaviour - is there a workaround &/or issue created for this?

You needed the format dd, but wrote DD. The first would be the day of the month, the second is the day of the year. Therefore that part of your date, which translates to the first of January, overwrote your month.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.