_dateparsefailure mapping date and time to @timestamp field

Elastic Stack Logstash
1

I am getting a _dateparsefailure when I try to map the date and time the log arrived to the @timestamp field. Below is my filter, if I comment out the attempt to map to @timestamp I dont get a _dateparsefailure so it somethhing with match => [ "timestamp", "yyy-MM-dd HH:mm:ss"]
The log is as follows:

2021-04-22-07.29.58.938095

grok   {

       pattern_definitions => {
                      "CUSTOMTIMESTAMP" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY}\S+%{HOUR}.%{MINUTE}.%{SECOND}"
        }
        match => { "message" => [ "%{CUSTOMTIMESTAMP:timestamp}
        }


date {
        match => [ "timestamp", "yyyy-MMM-dd HH:mm:ss" ]
        target => "@timestamp"
      }
2

The string of your timestamp needs to match the pattern in the date filter, which is not happening.

Your pattern in the date filter is yyyy-MMM-dd HH:mm:ss, this pattern will expect a date with the following format: 2021-Apr-28 10:47:23, for example.

Your date is in the format 2021-04-22-07.29.58.938095, so it won't match.

Try to use this pattern in the date filter: yyyy-MM-dd-HH.mm.ss.SSSSSS

3

Worked. THX

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.