_dateparsefailure csv date time YYYY-MM-dd HH:mm:ss

Elastic Stack Logstash
1

Hi,

I manage to parse message field from a csv to several fields from filebeat to logstash, I want to match a date format (like 2020-06-18 22:36:21) but when I use date and match filter it give me _dateparsefailure I tried with grok and it show _grokparsefailure".

The message from filebeat is:

"message" => "\"2020-06-18 23:34:51\",\"2020-06-18 23:34:51\",\"2020-06-18 23:35:24\",...more fields.

I parse and I have the 3 first fields in start, answer and end fields:

ej:
"start" => "2020-06-18 23:34:51"
I want this field to be the timestamp.

grok pattern use and date plugin usage is like this:

   grok {
      match => {
        "start" => "YYYY-MM-dd HH:mm:ss"
      }
    }

    date {
      match => ["start", '"YYYY-MM-dd HH:mm:ss"']
      timezone => "%{[logstash][timezone]}"
      target => "@timestamp"
    }

Any help will be apreciated.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.