I tried using the mutate+convert strategy but still got _dateparsefailure:
filter {
mutate {
copy => {"@timestamp" => "timestamp" }
convert => { "timestamp" => "string" }
}
date {
match => ["timestamp", "ISO8601"]
locale => "en-US"
timezone => "America/Sao_Paulo"
target => "timestamp"
}
}
but why would you want to that? It is already parsed!
Basically, I'm sending this output to a Big Data Platform that is expecting to receiving this input:
{"@timestamp":"2019-08-26T23:48:31.931Z","timestamp":"2019-08-26T20:48:30.347-03:00"}
So I'm trying to convert the bellow, into the above:
{"@timestamp":"2019-08-26T23:48:31.931Z","timestamp":1567637837587}