Help _dateparsefailure

[renaton5 (Renato)]

Hi,

I have a CSV, and the field TIME have this format [12/May/2017:00:00:00 -0300].

[12/May/2017:00:00:00 -0300]|Belo Horizonte|MG
[12/May/2017:01:00:00 -0300]|São Paulo|SP
[12/May/2017:02:00:00 -0300]|Rio de Janeiro|RJ

How can I convert these field to a timestamp?

My Conf filters:

filter {
csv {
columns => [
"Time",
"City",
"UF",
]
separator => "|"
}

date {
match => [ "Time" , "dd/MMM/yyyy:HH:mm:ss" ]
target => "@timestamp"
}

[warkolm (Mark Walkom)]

You are missing the TZ part in your match.

[renaton5 (Renato)]

Hi!

Can you give an example?

I'm begginer in logstash...

[warkolm (Mark Walkom)]

https://www.elastic.co/guide/en/logstash/current/plugins-filters-date.html#plugins-filters-date-match has what you want, just search for the timezone notation

[renaton5 (Renato)]

I have setted Z or Z in the match and the problema persists...

Can you check my sintax?

date {
match => [ "Time" , "dd/MMM/yyyy:HH:mm:ss Z" ]
target => "@timestamp"
}