I have a log line that reads something like the following (there is a space between the date and time, not a new line):
2017-06-07 10:15:42.406424+00:00,CSLUR,3,###########,###########,0xffffffff,310,026,61002,R,15,U,H
My logstash filter reads as such:
if ([message] =~ "CSLUR") {
csv {
columns => [
"date",
"event_type",
"log_ver",
"imsi",
"imei",
"tmsi",
"mcc",
"mnc",
"lac",
"acceptorreject",
"cause_code",
"whitelist",
"guest"
]
}
date {
match => [ "date", "ISO8601", "yyyy-MM-dd HH:mm:ss.SSSZZ" ]
}
}
I keep getting dateparsefailures and the @timestamp field is still read time, not message time. How do I debug the dateparsefailure?