Date Filter recognized string format

Hi everyone!
I have a problem using the logstash date filter. I have a date string formatted like this:
in a field (called scheduledTime) of a json log.

I need to convert this string into a date to index into Elasticsearch. I'm trying to use the date filter like this
date {
match => ["scheduledTime", "ddMMyyyy'T'HHmmss"]
but this doesn't work. But if I change the way the string is formatted, using the following format
and then change the format specified in the date filter like this
date {
match => ["scheduledTime", "yyyy-MM-dd'T'HH:mm:ss"]
everything works fine and scheduledTime field is indexed as Date on Elasticsearch.

My question is: how can I use the date filter to use the first format (ddMMyyyy'T'HHmmss)? Is there somethins else I need to specify somewhere?


Parsing a field with that pattern works just fine

    mutate { add_field => { "scheduledTime" => "20101999T123456" } }
    date { match => ["scheduledTime", "ddMMyyyy'T'HHmmss"] }


"scheduledTime" => "20101999T123456",
   "@timestamp" => 1999-10-20T12:34:56.000Z

Can you show us with a rubydebug codec on stdout exactly what you think fails to get parsed?

Yes, you are right. The date string in the produced log are in a format different from what was comunicated :frowning:. Sorry for the misunderstanding and thank you very much for your support.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.