I am using Winlogbeat to ship Windows Event Logs to LogStash.
According to "codec=>rubydebug", the JSON output contains a field named "@timestamp". So, I used Date Filter to parse it and got an error:
"@timestamp" = "2016-02-29T21:01:37.300Z"
match => ["@timestamp" , "ISO8601" }
target => "arrive_at"
I see no "arrive_at" field in the output.
message=>"failed parsing date from field",:field=>"@timestamp", :value=>"2016-02-29T21:01:37.300Z", exception="cannot convert instance of class org.jruby.RubyObject to class java.lang.string", :config_parsers=>"ISO8601",..."
I thought ISO8601 will match this date format.
Also, this date is 5 hrs ahead of my time zone here. How do I convert it to EST?
Thank you anyone who can help me on this. I have been trying to understand how Date Filter works but have failed miserably.