Dateparsefailure in date filter

[pgprb]

Hi there,

I'm always having dateparsefailure while doing a simple date filter to convert a string to date. The date format that I am passing is this:

2018-05-10 11:36:15

And right now in the conf file I have:

date {
match => ["ServerTimestamp", "yyyy-MM-dd HH:mm:ss"]
target => "ServerTime"
}

The field ServerTimestamp is a string. I have changed the date filter a lot of times (YYYY-MM-dd and on) and I'm always having dateparsefailure so I have no idea what am I doing wrong.

Many thanks,

[Badger]

If your events contained a field called ServerTimestamp in that format then that date filter would parse it, and not add a _dateparsefailure tag. So I infer that either the field is not named ServerTimestamp, or it is not in that format. Can you show us an event using output { stdout { codec => rubydebug } }, or if you are using Kibana, copy and paste from the JSON tab in Discover.

[pgprb]

Hi @Badger

This is a small copy from the JSON

"CollectPublishingInstances": [
19.12
],
"ServerTimestamp": [
** "2018-05-10 11:36:15"**
],
"SaveValues_": [
14.81
],

As you can see, there is a field named ServerTimestamp and has that format.

Thanks!

[Badger]

It an array.

mutate { replace => { "ServerTimestamp" => "%{[ServerTimestamp][0]}"

If everything is an array because you parsed it using an xml filter, you might want to see if force_array => false works for you.

[pgprb]

This worked, thank you very much @Badger