Date Parsing issue

Elastic Stack Logstash
1

I am trying to get the date from the following line

> [Tue Jan 23 11:32:45 2018] [DEBUG] Client.java(): ClientListGet

To which I wrote the following configuration for logstash

filter {
date {
match => ["timestamp","EEE MMM dd HH:mm:ss yyyy"]
target => "@timestamp"
locale => "en"
}
}

It doesn't parse and map the result to @timestamp field and the result is below, There is no error returned at this time

{
      "@version" => "1",
          "host" => "xhost.com",
    "@timestamp" => 2018-02-11T07:04:14.666Z,
       "message" => "[Tue Jan 23 11:32:45 2018] [DEBUG] Client.java(): ClientListGet"
}

For the following configuration dateparsefailure is thrown

filter {
date {
match => ["@timestamp","EEE MMM dd HH:mm:ss yyyy"]
locale => "en"
}
}

Is there any configuration needs to be changed to get it working

2

{
"@version" => "1",
"host" => "xhost.com",
"@timestamp" => 2018-02-11T07:04:14.666Z,
"message" => "[Tue Jan 23 11:32:45 2018] [DEBUG] Client.java(): ClientListGet"
}

This event has no timestamp field to parse.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.