How I can replace time with actual time in my log file?

While uploading my data, the time field is getting update with the uploading time.

Given below is my sample data

<134> id=firewall sn=C0EAE4F8239E time="2019-03-01 03:26:12 UTC" fw= pri=6 c=1024 m=537 msg="Connection Closed" app=49279 appName="Service SMB" n=1083492749 src= dst= proto=tcp/445 sent=52 spkt=1

Code I'm using

date {
match => ["time" , "yyyy-MM-dd' HH:mm:ss ZZZ"]
remove_field => [ "timestamp" ]

Remove the ' at the end of the date pattern in your date filter. I would also remove the remove_field option since it does nothing.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.