Date format in elasticsearch

(pecwich) #1

While sending logs from logstash to elasticsearch, How can I specify my date within the logs to "date" format, rather than just a string?

(Mark Walkom) #2

You should be groking your field in LS and then applying a date filter on it, that should work and it'll be standardised.
Otherwise setup a template that matches the field.

(pecwich) #3

Can you give an example of how can I apply the date filter?

For example, in my use case, the date format is like: 11 Mar 2016 02:15:46,853

Right now, I am using it like a string. I want it to be of date format which I can apply using either a template, or the date filter like you just said. How can I do that?

(Mark Walkom) #4 will get you sorted!

(pecwich) #5

I am parsing my logs using the date format, but it is not appearing as a field in the logstash output.

filter {
/* parsing of the entire log message */
date {
match => [ "logdate", "dd MMM YYYY HH:mm:ss,SSS" ]

(pecwich) #6

Can you let me know the solution to my specific problem, i.e. , the date format?

(system) #7