Date filter question - what happens if two formats match?

Elastic Stack Logstash
1

If date {} ‘s match method is used, and multiple formats are supplied to match against, what happens if more than one format matches? Does it just use the first match made, the last match made, or something else?

date {
match => [ "timestamp", "format1", "format2" ]
}

(Both format 1 and format 2 match.)

2

The patterns are tried in order and the first match wins.

1 Like
3

Thank you, and especially for taking the time to get the code showing it.