Date format representation for "2020-01-29T21:40:00.000+0000" to assign to @timestamp

HI,

I need to assign the string in format "2020-01-29T21:40:00.000+0000" to @timestamp.
Used date filter . How is the format represented exactly ?
date {

  match => [ "[sampleDate]",  "ISO8601"]
  #match => [ "[sampleDate]",  "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'" ]

}

If [sampleDate] contains "2020-01-29T21:40:00.000+0000" then that date filter will produce

"@timestamp" => 2020-01-29T21:40:00.000Z,

In the next step i try to do the following to assign valid timestamp to sampleDate

date {
match => [ "[sampleDate]", "ISO8601"]
target => "sampleDate"
}

and have the type for sampleDate as "date" in mapping template. However it errors out.
ERROR below:

"mapper_parsing_exception", "reason"=>"failed to parse field [sampleDate] of type [long] in document with id '9460474694a76b4d1823bf06805f9d47cc2701509279045fb07acbcab31c154eaead59d98825a39ae409aa2cc75b7a1f52802a8c394afc83c68749354a0539d1'. Preview of field's value: '2020-01-30T19:31:40.000Z'", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"For input string: "2020-01-30T19:31:40.000Z""}}}}}

NOTE: I also tried mutate copy @timestamp(after mapping) to sampleDate but that errors out too while indexing the data to ES

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.