Hi. I've tried this as well but am still having the issue where the match string now matches the Time attribute rather than the log timestamp. My current config looks like so:
input {
kafka {
bootstrap_servers => "kafka02.company.net:9093"
topics => ["Capsule_logs"]
}
}
filter{
grok {
patterns_dir => ["/etc/logstash/patterns"]
match => [ "message", "%{LOGTIMESTAMP:logTimestamp}" ]
}
date {
timezone => "UTC"
match => ["logTimestamp", "MMM d HH:mm:ss"]
target => "logTimestamp"
}
}
output {
elasticsearch {
hosts => ["https://user:password.deployment-logs.company.com:17825/"]
ssl => true
ssl_certificate_verification => true
}
}
I tried the locale parameter which caused a dateparse error. I realize once this is working I'll have to add an additional match parameter for dd.
Thanks!