Date format - fused string

I'm trying to parse 180711T221704.507399z into @timestamp with

date {
match => ["log_time","yyMMddHHmmss.SSSSSS"]

but keep getting "dateparsefailure".

I've tried "ISO8601", adding the T, z, and a everything short of breaking it up. Appreciate suggestions.

Have you tried yyMMddHHmmss.SSSSSS'z' (yes, with single quotes around the "z")?

yup. same result

date { match => [ "message", "yyMMdd'T'HHmmss.SSSSSS'z'" ] }

works for me.

1 Like

giddeeup! yes this works.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.