Define time format as date prompt error

[shenshensinian]

Error message：failed to parse field [timestamp] of type [date]

Time sample format：

mar 13 10:36:03
mar 13 2019 10:36:03
2019-03-13 11:11:11

I want to be able to convert different date formats into yyyy-MM-dd hh:mm:ss

[yaauie (Ry Biesemeyer)]

You can use the Date Filter Plugin to parse any number of formats into a Time object, which serialises to a ISO8601-compatible representation.

It's not clear to me exactly what format strings to recommend, because it depends on whether your inputs zero-pad the day-of-month or hour-of-day fields; for example, the first input you give could be any of:

• mar 13 10:36:03
  • MMM d H:mm:ss (minimal day-of-month; minimal hour-of-day)
  • MMM d HH:mm:ss (minimal day-of-month; zero-padded two-digit hour-of-day)
  • MMM dd H:mm:ss (zero-padded two-digit day-of-month; minimal hour-of-day)
  • MMM dd HH:mm:ss (zero-padded two-digit day-of-month; zero-padded two-digit hour-of-day)

I would advise using the above-linked docs to define appropriate format strings.

[shenshensinian]

I want to know how to convert multiple formats into one format.

[shenshensinian]

@yaauie

You can use the Date Filter Plugin to parse any number of formats into a Time object, which serialises to a ISO8601-compatible representation.

It's not clear to me exactly what format strings to recommend, because it depends on whether your inputs zero-pad the day-of-month or hour-of-day fields; for example, the first input you give could be any of:

• mar 13 10:36:03
  • MMM d H:mm:ss (minimal day-of-month; minimal hour-of-day)
  • MMM d HH:mm:ss (minimal day-of-month; zero-padded two-digit hour-of-day)
  • MMM dd H:mm:ss (zero-padded two-digit day-of-month; minimal hour-of-day)
  • MMM dd HH:mm:ss (zero-padded two-digit day-of-month; zero-padded two-digit hour-of-day)

I would advise using the above-linked docs to define appropriate format strings.

[14/Mar/2017:06:57:12 +0800] How to convert this into "2017-11-20 12:00:00" in logstash

[yaauie (Ry Biesemeyer)]

Please read the linked documentation, try it for yourself, and come back with a description of what you tried, what you expected to happen, and what behaviour you observed if you are still having problems.

[shenshensinian]

After matching the timestamp with the target to the timestamp by matching, the time is automatically reduced by 8 hours.

[shenshensinian]

@yaauie

Please read the linked documentation, try it for yourself, and come back with a description of what you tried, what you expected to happen, and what behaviour you observed if you are still having problems.

Solved, thank you.