_dateparsefailure ISO8106

Elastic Stack Logstash
1

Elasticstack 6.1

I am trying to parse the following field/date:
"EventTime":"2018-02-08 12:43:35.951854Z"

I have used:

filter {   
  date {
    match => [ "EventTime", "yyyy-MM-dd HH:mm:ss:SSSZ" ]
  }
}

filter {   
  date {
    match => [ "EventTime", "ISO8106" ]
  }
}

And they all return a _dateparsefailure

I am not sure how to get the date to parse correctly

2

match => [ "EventTime", "yyyy-MM-dd HH:mm:ss:SSSZ" ]

Have you tried SSSSSSS instead of SSS? Also, your date has a period between the seconds and microseconds, not a colon.

match => [ "EventTime", "ISO8106" ]

It's ISO8601.

3

This eventually worked

filter {   
  date {
    match => ["EventTime", "yyyy-MM-dd HH:mm:ss.SSSSSSZ", "ISO8601" ]
  }
}

ISO8601 itself didn't work

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.