_dateparsefailure mapping date and time to @timestamp field

I am getting a _dateparsefailure when I try to map the date and time the log arrived to the @timestamp field. Below is my filter, if I comment out the attempt to map to @timestamp I dont get a _dateparsefailure so it somethhing with match => [ "timestamp", "yyy-MM-dd HH:mm:ss"]
The log is as follows:


grok   {

       pattern_definitions => {
                      "CUSTOMTIMESTAMP" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY}\S+%{HOUR}.%{MINUTE}.%{SECOND}"
        match => { "message" => [ "%{CUSTOMTIMESTAMP:timestamp}

date {
        match => [ "timestamp", "yyyy-MMM-dd HH:mm:ss" ]
        target => "@timestamp"

The string of your timestamp needs to match the pattern in the date filter, which is not happening.

Your pattern in the date filter is yyyy-MMM-dd HH:mm:ss, this pattern will expect a date with the following format: 2021-Apr-28 10:47:23, for example.

Your date is in the format 2021-04-22-, so it won't match.

Try to use this pattern in the date filter: yyyy-MM-dd-HH.mm.ss.SSSSSS

Worked. THX

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.