Define time format as date prompt error

(shenshensinian) #1

Error message:failed to parse field [timestamp] of type [date]

Time sample format:

mar 13 10:36:03
mar 13 2019 10:36:03
2019-03-13 11:11:11

I want to be able to convert different date formats into yyyy-MM-dd hh:mm:ss

(Ry Biesemeyer) #2

You can use the Date Filter Plugin to parse any number of formats into a Time object, which serialises to a ISO8601-compatible representation.

It's not clear to me exactly what format strings to recommend, because it depends on whether your inputs zero-pad the day-of-month or hour-of-day fields; for example, the first input you give could be any of:

  • mar 13 10:36:03
    • MMM d H:mm:ss (minimal day-of-month; minimal hour-of-day)
    • MMM d HH:mm:ss (minimal day-of-month; zero-padded two-digit hour-of-day)
    • MMM dd H:mm:ss (zero-padded two-digit day-of-month; minimal hour-of-day)
    • MMM dd HH:mm:ss (zero-padded two-digit day-of-month; zero-padded two-digit hour-of-day)

I would advise using the above-linked docs to define appropriate format strings.

(shenshensinian) #3

I want to know how to convert multiple formats into one format.

(shenshensinian) #4

[14/Mar/2017:06:57:12 +0800] How to convert this into "2017-11-20 12:00:00" in logstash

(Ry Biesemeyer) #5

Please read the linked documentation, try it for yourself, and come back with a description of what you tried, what you expected to happen, and what behaviour you observed if you are still having problems.

(shenshensinian) #6

After matching the timestamp with the target to the timestamp by matching, the time is automatically reduced by 8 hours.

(shenshensinian) #7

Solved, thank you.

(system) closed #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.