Date filter: Text Time zone names (z) cannot be parsed

Hi - I am having

a. May 30, 2017 10:13:48 PM EST date and time format.

b. grokking with (?\s?%{MONTH}\s+%{MONTHDAY},\s+%{YEAR}\s?%{HOUR}:%{MINUTE}:%{SECOND}\s+[[Aa]|[Pp]][Mm]?\s+%{TZ}) - Grok works perfect.

c. using date filter to store @timestamp with mylocaltimestamp.

using date filter I get _dateparsefailure error. How to deal with short timezones

Joda equivalent is : z time zone text Pacific Standard Time; PST
Date filter: z time zone names. Time zone names (z) cannot be parsed.

`date {
      		  match => [ "mylocaltimestamp", "MMM dd, YYYY hh:mm:ss a Z" ]
         timezone => "America/New_York"
         target => "@timestamp"
     }`

--ouput

{
            "path" => "C:\\Users\\d452\\Downloads\\ELK\\input\\logstash-Input.txt",
      "@timestamp" => 2017-06-05T15:54:12.267Z,
"mylocaltimestamp" => "May 30, 2017 10:13:48 PM EDT",
        "@version" => "1",
            "host" => "LT-00008443",
         "message" => "May 30, 2017 10:13:48 PM EST\r",
            "type" => "localfile",
            "tags" => [
    [0] "_dateparsefailure"
]

}

How to address text timezone when it cannot be parsed with date filter.

Thanks for time,

Looking at the forum posts.

Below are options

  1. use Translate Filter
  2. Change log format.

Thanks,

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.