Help with Date

[debarun (debarun ghosh)]

Hi,

I need to replace the time coming from the logs to timestamp field.

But i keep getting a parse failure.

The loglines look like

Time Stamp 11/14/16 15:14:25 Event Number 2004

I am using the following filters:-

grok {
patterns_dir => [ "/etc/logstash/conf.d/pattern" ]
match => [ "message","Time Stamp %{DATE:logdate} %{TIME:logtime} Event Number %{NUMBER:enevtnumber} ]
}

mutate {
add_field => {
"timestamp" => "%{logdate} %{logtime}"
}}

date {
locale => "en"
match => [ "timestamp" , "dd/mm/yy HH24:mi:ss" ]
}

[debarun (debarun ghosh)]

Hi,

Any help is welcome.

Regards,
Debarun.

[txisme]

i have this and it works:

 date
                    {
                            match => ["time3", "UNIX_MS"]
                                    target => "myTime"
                    }

so try to add the target line to create your timestamp variable.

[Hans]

Maybe this will work for you:
date { locale => "en" match => ["timestamp", "dd/MM/YY HH:mm:ss", "ISO8601"] timezone => "Africa/Windhoek" target => "@timestamp" add_field => { "debug" => "timestampMatched"} }

[aeva_assured (Andrew)]

In the example you posted you are missing the trailing quotation in your match pattern.

match => [ "message","Time Stamp %{DATE:logdate} %{TIME:logtime} Event Number %{NUMBER:enevtnumber} ]

should be

match => [ "message","Time Stamp %{DATE:logdate} %{TIME:logtime} Event Number %{NUMBER:enevtnumber}"]

[debarun (debarun ghosh)]

Hi Guys,

Thanks for the response.

@Hans

This one worked , Thanks once again.

regards,
Debarun