Failed parsing date from field


(nivetha) #1

I am trying to parse the date with different timezone, but I get the "Failed parsing date from field".
I dont know where I go wrong.
Here are the conf I use:
filter{
date{
match => [ "eventTime", "YYYY/MM/dd HH:mm:ss.SS" , "YYYY/MM/dd HH:mm:ss.SSS" , "YYYY/MM/dd HH:mm:ss.SSSSSSZ", "YYYY/MM/dd HH:mm:ss.SSSSSSZZ"]
add_tag => ["date_filter"]
target => "@timestamp"
}
}

The dates in eventTime field to be matched are:
2015/12/15 05:05:9.957 , 2015/12/15 05:05:9.393040 +00:00 , 2015/12/15 05:05:9.393040 +0530


#2

2015/12/15 05:05:9.957 => yyyy/MM/dd HH:mm:ss.SSS you already have this one

2015/12/15 05:05:9.393040 +00:00 => yyyy/MM/dd HH:mm:s.SSSSSS ZZ because

  • seconds without leading zero => single s
  • space between time and timezone
  • ZZ because of timezone use the ':' separator

2015/12/15 05:05:9.393040 +0530 => yyyy/MM/dd HH:mm:s.SSSSSS Z because

  • seconds without leading zero => single s
  • space between time and timezone
  • Z because of timezone use the simple form without ':' separator

(system) #3