Date Filter recognized string format

Hi everyone!
I have a problem using the logstash date filter. I have a date string formatted like this:
ddMMyyyy'T'HHmmss
in a field (called scheduledTime) of a json log.

I need to convert this string into a date to index into Elasticsearch. I'm trying to use the date filter like this
date {
match => ["scheduledTime", "ddMMyyyy'T'HHmmss"]
}
but this doesn't work. But if I change the way the string is formatted, using the following format
yyyy-MM-dd'T'HH:mm:ss
and then change the format specified in the date filter like this
date {
match => ["scheduledTime", "yyyy-MM-dd'T'HH:mm:ss"]
}
everything works fine and scheduledTime field is indexed as Date on Elasticsearch.

My question is: how can I use the date filter to use the first format (ddMMyyyy'T'HHmmss)? Is there somethins else I need to specify somewhere?

Regards,
Antonio.

Parsing a field with that pattern works just fine

    mutate { add_field => { "scheduledTime" => "20101999T123456" } }
    date { match => ["scheduledTime", "ddMMyyyy'T'HHmmss"] }

produces

"scheduledTime" => "20101999T123456",
   "@timestamp" => 1999-10-20T12:34:56.000Z

Can you show us with a rubydebug codec on stdout exactly what you think fails to get parsed?

Yes, you are right. The date string in the produced log are in a format different from what was comunicated :frowning:. Sorry for the misunderstanding and thank you very much for your support.

Regards
Antonio.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.