Date filter: Text Time zone names (z) cannot be parsed

Elastic Stack Logstash
1

Hi - I am having

a. May 30, 2017 10:13:48 PM EST date and time format.

b. grokking with (?\s?%{MONTH}\s+%{MONTHDAY},\s+%{YEAR}\s?%{HOUR}:%{MINUTE}:%{SECOND}\s+[[Aa]|[Pp]][Mm]?\s+%{TZ}) - Grok works perfect.

c. using date filter to store @timestamp with mylocaltimestamp.

using date filter I get _dateparsefailure error. How to deal with short timezones

Joda equivalent is : z time zone text Pacific Standard Time; PST
Date filter: z time zone names. Time zone names (z) cannot be parsed.

`date {
      		  match => [ "mylocaltimestamp", "MMM dd, YYYY hh:mm:ss a Z" ]
         timezone => "America/New_York"
         target => "@timestamp"
     }`

--ouput

{
            "path" => "C:\\Users\\d452\\Downloads\\ELK\\input\\logstash-Input.txt",
      "@timestamp" => 2017-06-05T15:54:12.267Z,
"mylocaltimestamp" => "May 30, 2017 10:13:48 PM EDT",
        "@version" => "1",
            "host" => "LT-00008443",
         "message" => "May 30, 2017 10:13:48 PM EST\r",
            "type" => "localfile",
            "tags" => [
    [0] "_dateparsefailure"
]

}

How to address text timezone when it cannot be parsed with date filter.

Thanks for time,

2

Looking at the forum posts.

Below are options

  1. use Translate Filter
  2. Change log format.

Thanks,

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.