How can I use the date filter (match) with many fields


I want to match the date from a cvs file that comes in different fields with logstash! The date in the cvs file come in four fields (four columns) for example:

180314 |16 | 40 |45|

I was trying to do this but only is working with the field "Fecha_Trans" in the timestamp but is not recognizing the HH field, MM field and SS. ¿How Can I nest the fields?

date {
match => [ "Fecha_Trans", "yyMMdd" ]
match => ["HH", "HH"]
match => ["MM", "mm"]
match => ["SS", "ss"]

The date filter parses a single field. If your timestamp is spread over multiple fields you'll have to combine them first. You can e.g. use a mutate filter for that.

Hello Magnusbaeck!

Thanks so much for your reply! I'm so sorry I'm new with this tool of logstash, do you have any suggestions of which type of mutate filter can I use?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.