Filebeat timestamp processor is unable to parse timestamp as expected.
Log file -
26/Aug/2020:08:00:30 +0100 26/Aug/2020:08:02:30 +0100
Filebeat config -
filebeat.inputs: - type: log paths: - /logs/tp1.log processors: - timestamp: field: message timezone: 'Europe/London' layouts: - '02/Jan/2006:15:04:05 +0100' test: - '26/Aug/2020:08:02:30 +0100' output.console: pretty: true
`2020-08-27T09:54:56.185+0100 DEBUG [processor.timestamp] timestamp/timestamp.go:81 Test timestamp [26/Aug/2020:08:02:30 +0100] parsed as [2020-01-26 08:02:30 +0000 UTC]`
So as you see when timestamp processor tries to parse the datetime as per the defined layout, its not working as expected i.e.
26/Aug/2020:08:02:30 +0100 is parsed as 2020-01-26 08:02:30 +0000 UTC
Note the month is changed from Aug to Jan by the timestamp processor which is not expected.
I don't know if this is a known issue but i can't get it working with the current date format and using a different date format is out of question as we are expecting date in the specified format from several sources.
I would appreciate your help in find a solution to this problem.
Thanks in advance