Date Filter recognized string format

(Antonio Addivinola) #1

Hi everyone!
I have a problem using the logstash date filter. I have a date string formatted like this:
ddMMyyyy'T'HHmmss
in a field (called scheduledTime) of a json log.

I need to convert this string into a date to index into Elasticsearch. I'm trying to use the date filter like this
date {
match => ["scheduledTime", "ddMMyyyy'T'HHmmss"]
}
but this doesn't work. But if I change the way the string is formatted, using the following format
yyyy-MM-dd'T'HH:mm:ss
and then change the format specified in the date filter like this
date {
match => ["scheduledTime", "yyyy-MM-dd'T'HH:mm:ss"]
}
everything works fine and scheduledTime field is indexed as Date on Elasticsearch.

My question is: how can I use the date filter to use the first format (ddMMyyyy'T'HHmmss)? Is there somethins else I need to specify somewhere?

Regards,
Antonio.

#2

Parsing a field with that pattern works just fine

    mutate { add_field => { "scheduledTime" => "20101999T123456" } }
    date { match => ["scheduledTime", "ddMMyyyy'T'HHmmss"] }

produces

"scheduledTime" => "20101999T123456",
   "@timestamp" => 1999-10-20T12:34:56.000Z

Can you show us with a rubydebug codec on stdout exactly what you think fails to get parsed?

(Antonio Addivinola) #3

Yes, you are right. The date string in the produced log are in a format different from what was comunicated :frowning:. Sorry for the misunderstanding and thank you very much for your support.

Regards
Antonio.