Exception Handling

If the date parsing fails the message will by default get the tag _dateparsefailure so you can do something like this:

filter {
  date {
    ...
  }
}

output {
  if "_dateparsefailure" in [tags] {
    file {
      path => ".../date_parse_errors.log"
    }
  }
}
2 Likes