xyz2
September 21, 2018, 6:40pm
1
I need to pick the time from a file and use that for @timestamp . The format of time in file is below
2018-08-30 00:01:23|abc|xy777777
match => ["message","%{TIMESTAMP_ISO8601:time}|..........]
}
date {
match => [ "time" , "ISO8601" ]
}
Doesn't work.
also tried
date {
match => [ "time" , "yyyy-MM-dd HH:mm:ss" ]
}
What does an example event produced by Logstash look like? Copy/paste from Kibana's JSON tab or use a stdout { codec => rubydebug }
output.
xyz2
September 21, 2018, 7:01pm
3
Hi,
I use below
output {
elasticsearch {
index => "x-%{+YYYY.MM.dd}"
hosts => ["localhost:9200"]
}
xyz2
September 21, 2018, 8:04pm
4
For the first case, it gives below
"time": "2018-08-29 00:04:40",
"@timestamp ": "2018-09-21T19:58:11.545Z",
xyz2
September 21, 2018, 8:17pm
5
When I use
date {
match => [ "time" , "yyyy-MM-dd HH:mm:ss" ]
}
I receive the response below for input file data having 2018-08-29 00:06:52
"time": "2018-08-29 00:06:52",
"@timestamp ": "2018-08-29T04:06:52.000Z",
If your timezone is UTC-4 then things are working fine. @timestamp
is always UTC.
system
(system)
Closed
October 20, 2018, 5:55pm
7
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.