Date parsing not working

Elastic Stack Logstash
1

Hi i have a date field that i need to parse having this format:

Wed Nov 1 02:04:55 2017

my date filter would be :

date { 
              match => ["hpna_time", "MMM  d HH:mm:ss YYYY"]
                  timezone => "Europe/Paris"
}

the parsing didn't work is there a way to eliminate the Wed ?

thank you!

2

EEE MMM d HH:mm:ss YYYY should work.

3

thank you i have two days Oct 31 and Nov 1, the parsing is only applied on Nov 1

these are date formats from my log file

Wed Nov 1 07:01:39 2017 ==> (there is two spaces between Nov and 1)
Tue Oct 31 14:03:29 2017

so i 've tried

match => [ "hpna_time" , "EEE MMM d HH:mm:ss YYYY" , "EEE MMM dd HH:mm:ss YYYY" ]

no the parsing is applied on Oct 31 and not Nov 1

what should i do please?

4

Do you have two spaces before "d" in your first pattern?

When the filter fails it logs a message that points to the part of the string where the error is.

5

yes i had two spaces before my first d patterns like in the log file then i've changed it
and it works now thanks !

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.