Extract datatime in log and convert in datatime field?

i ve this config in logstash

filter
{

grok {
   match => ["message", "%{TIMESTAMP_ISO8601:timestamp_message}"]
}


  date {
           match => ["timestamp_message","YYYY-MM-dd HH:mm:ss"]
           target => "@timestamp"
      } 
}

but in my kibana "timestamp_message" is not datetime filelds and is not have order

Your [timestamp_message] field has milliseconds. Your date filter has to consume that. Try "YYYY-MM-dd HH:mm:ss,SSS".

hello i've resolved with


grok {
   match => ["message", "%{TIMESTAMP_ISO8601:logmessage}"]
 }


           
           date {
	         match => [ "logmessage", "ISO8601", "YYYY-MM-dd HH:mm:ss" ]
	         target => "logdate"
	        
        }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.