Grok and date plugin


#1

I need to pick the time from a file and use that for @timestamp. The format of time in file is below
2018-08-30 00:01:23|abc|xy777777

match => ["message","%{TIMESTAMP_ISO8601:time}|..........]
}

date {
    match => [ "time" , "ISO8601" ]
    
}

Doesn't work.

also tried
date {
match => [ "time" , "yyyy-MM-dd HH:mm:ss" ]

}

(Magnus Bäck) #2

What does an example event produced by Logstash look like? Copy/paste from Kibana's JSON tab or use a stdout { codec => rubydebug } output.


#3

Hi,
I use below

output {
elasticsearch {
index => "x-%{+YYYY.MM.dd}"
hosts => ["localhost:9200"]
}


#4

For the first case, it gives below

"time": "2018-08-29 00:04:40",
"@timestamp": "2018-09-21T19:58:11.545Z",


#5

When I use
date {
match => [ "time" , "yyyy-MM-dd HH:mm:ss" ]

}

I receive the response below for input file data having 2018-08-29 00:06:52
"time": "2018-08-29 00:06:52",
"@timestamp": "2018-08-29T04:06:52.000Z",


(Magnus Bäck) #6

If your timezone is UTC-4 then things are working fine. @timestamp is always UTC.


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.