Grok Custom Timestamp Filter

Elastic Stack Logstash
1

Am not able to filter the following date through grok, it doesnt fall under any ready made TIMESTAMP filters:

07 Aug 2019 13:54:27.463

I want to retrive it and replace it with @timestamp (or create a "Date" variable and add it there)

Thanks

2

Hi,

You can use the Date Filter to create arbitrary (and multiple) patterns for handling date/time stamps.

3

@ben.west I know about the Date Filter but am not able to find the right syntax to fit with my need. Can you please advise?

4

This should work: dd MMM yyyy HH:mm:ss.SSS

5

how would the whole config be in this case? like this?

date {
     match => [ "Date", "dd MMM yyyy HH:mm:ss.SSS" ]
     target => "Date"
    }
6

Yes that should work. You mentioned in your original post you wanted to update the @timestamp field of the event so you can omit the target to do this automatically.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.