Date format - fused string


(Donald Fabozzi) #1

I'm trying to parse 180711T221704.507399z into @timestamp with

date {
match => ["log_time","yyMMddHHmmss.SSSSSS"]
}

but keep getting "dateparsefailure".

I've tried "ISO8601", adding the T, z, and a everything short of breaking it up. Appreciate suggestions.


(Magnus B├Ąck) #2

Have you tried yyMMddHHmmss.SSSSSS'z' (yes, with single quotes around the "z")?


(Donald Fabozzi) #3

yup. same result


#4
date { match => [ "message", "yyMMdd'T'HHmmss.SSSSSS'z'" ] }

works for me.


(Donald Fabozzi) #5

giddeeup! yes this works.


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.