Dateparsefailure

[Muhammad_Faisal (abc123)]

hi all,
i have very simple input , why i am getting date parse failure here ?

`input {
stdin{}
}

filter {
date {
match => [ "message", "MMM dd yyyy HH:mm:ss" ]
}
}

    output {
stdout {
        codec => "rubydebug"
}

}`

Aug 13 2010 00:03:44

{
"@version" => "1",
"message" => "Aug 13 2010 00:03:44\r",
"@timestamp" => 2020-12-09T12:38:27.872Z,

      "tags" => [
    [0] "_dateparsefailure"
]

}

[aaron-nimocks]

Your message has a carriage return \r at the end of it for some reason. Can add the gsub like below to remove it.

But... you did stdin{} so maybe that just captured the carriage return. I tried it and couldn't duplicate that though. Maybe you copy/pasted the message and included the line below it into the command line?

input {
  generator {
    lines => [
     '{"logdate":"Aug 13 2010 00:03:44\r"}'
    ]
    count => 1
    codec => "json"
  }
}
filter {
  mutate { gsub => [ "logdate", "[\r]", "" ] }
  date {
    match => ["logdate", "MMM dd yyyy HH:mm:ss"]
    target => "logdate"
  }
}
output {
  stdout { codec =>  "rubydebug" }
}

Output

{
      "sequence" => 0,
          "host" => "xxx",
      "@version" => "1",
    "@timestamp" => 2020-12-09T14:10:57.493Z,
       "logdate" => 2010-08-13T06:03:44.000Z
}