Date format - fused string

(Donald Fabozzi) #1

I'm trying to parse 180711T221704.507399z into @timestamp with

date {
match => ["log_time","yyMMddHHmmss.SSSSSS"]

but keep getting "dateparsefailure".

I've tried "ISO8601", adding the T, z, and a everything short of breaking it up. Appreciate suggestions.

(Magnus B├Ąck) #2

Have you tried yyMMddHHmmss.SSSSSS'z' (yes, with single quotes around the "z")?

(Donald Fabozzi) #3

yup. same result

date { match => [ "message", "yyMMdd'T'HHmmss.SSSSSS'z'" ] }

works for me.

(Donald Fabozzi) #5

giddeeup! yes this works.

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.