Date format - fused string

Elastic Stack Logstash
1

I'm trying to parse 180711T221704.507399z into @timestamp with

date {
match => ["log_time","yyMMddHHmmss.SSSSSS"]
}

but keep getting "dateparsefailure".

I've tried "ISO8601", adding the T, z, and a everything short of breaking it up. Appreciate suggestions.

2

Have you tried yyMMddHHmmss.SSSSSS'z' (yes, with single quotes around the "z")?

3

yup. same result

4 
date { match => [ "message", "yyMMdd'T'HHmmss.SSSSSS'z'" ] }

works for me.

1 Like
5

giddeeup! yes this works.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.