File Import Timestamps

Elastic Stack Beats
1

Hi,

Looking for some direction on how to utilize a combination of Filename (2019/02/21 - YYYY/MM/DD) and the first 8 characters of each line in the file (04:16:50 - HH:NN:SS) instead of the generic @timestamp being utilized by the Time Filter Field Name.

Haven't had much luck searching for answers, it's a pretty basic install of Elasticsearch, Logstash and Kibana on a single server with Filebeats sending the files to Elasticsearch :9200

2

There's probably a few ways to do this. With Logstash you could:

  • grok the date from the filename
  • grok the time from the message
  • create a new field using the mutate filter that joins %{filename_date} %{message_ts}
  • then use a date filter to set the @timestamp
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.