Help _dateparsefailure


(Renato ) #1

Hi,

I have a CSV, and the field TIME have this format [12/May/2017:00:00:00 -0300].

[12/May/2017:00:00:00 -0300]|Belo Horizonte|MG
[12/May/2017:01:00:00 -0300]|São Paulo|SP
[12/May/2017:02:00:00 -0300]|Rio de Janeiro|RJ

How can I convert these field to a timestamp?

My Conf filters:

filter {
csv {
columns => [
"Time",
"City",
"UF",
]
separator => "|"
}

date {
match => [ "Time" , "dd/MMM/yyyy:HH:mm:ss" ]
target => "@timestamp"
}


(Mark Walkom) #2

You are missing the TZ part in your match.


(Renato ) #3

Hi!

Can you give an example?

I'm begginer in logstash...


(Mark Walkom) #4

https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-match has what you want, just search for the timezone notation :slight_smile:


(Renato ) #5

I have setted Z or Z in the match and the problema persists...

Can you check my sintax?

date {
match => [ "Time" , "dd/MMM/yyyy:HH:mm:ss Z" ]
target => "@timestamp"
}


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.