Date match issue in logstash filter

Elastic Stack Logstash
1

"Tue Mar 21 2017 11:55:00 GMT-0400 (EDT)"

Could use a little help figuring out what I have wrong:
date{
match => [ "[ENTRY][Timestamp]", "YYYY-MM-dd HH:mm:ss.SSS Z", "ISO8601", "EEE MMM dd yyyy HH:mm:ss z", "EEE MMM dd yyyy HH:mm:ss Z" ]
}

:exception=>"Invalid format: "Tue Mar 21 2017 12:01:45 GMT-0400 (EDT)" is malformed at "GMT-0400 (EDT)"", :config_parsers=>"YYYY-MM-dd HH:mm:ss.SSS Z,ISO8601,EEE MMM dd yyyy HH:mm:ss z,EEE MMM dd yyyy HH:mm:ss Z", :config_locale=>"default=en_US", :level=>:warn}

2

https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html

Try
"EEE MMM dd yyyy HH:mm:ss 'GMT'Z '(EDT)'"

Although you might wish to mutate the field to get rid of the 'GMT' and trailing timezone TLA (since Logstash can't parse these).

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.