Date parsing not working

(Sylvio de cezare) #1

Hi i have a date field that i need to parse having this format:

Wed Nov 1 02:04:55 2017

my date filter would be :

date { 
              match => ["hpna_time", "MMM  d HH:mm:ss YYYY"]
                  timezone => "Europe/Paris"

the parsing didn't work is there a way to eliminate the Wed ?

thank you!

(Magnus Bäck) #2

EEE MMM d HH:mm:ss YYYY should work.

(Sylvio de cezare) #3

thank you i have two days Oct 31 and Nov 1, the parsing is only applied on Nov 1

these are date formats from my log file

Wed Nov 1 07:01:39 2017 ==> (there is two spaces between Nov and 1)
Tue Oct 31 14:03:29 2017

so i 've tried

match => [ "hpna_time" , "EEE MMM d HH:mm:ss YYYY" , "EEE MMM dd HH:mm:ss YYYY" ]

no the parsing is applied on Oct 31 and not Nov 1

what should i do please?

(Magnus Bäck) #4

Do you have two spaces before "d" in your first pattern?

When the filter fails it logs a message that points to the part of the string where the error is.

(Sylvio de cezare) #5

yes i had two spaces before my first d patterns like in the log file then i've changed it
and it works now thanks !

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.