How to date match "January 16th 2019, 07:00:09.257"?

[JimP (James Peppercorn)]

This should be easy, but for some reason I am unable to do this. Can someone help, please?

January 16th 2019, 07:00:09.257

Logstash 6.3.2

[Shaoranlaos (Christian Stockhaus)]

where do you which a match? in the date filter or in grok?

if it is the date filter there is a previous question with an untested solution

Need a date parser for my custom date fielsd

You probably need to strip away the "th" (and "nd" and "st") that can come after the day as the date filter isn't capable of ignoring it automatically. Or, specify multiple date patterns and let the filter try them all until it gets a match. Untested: date { match => [ "name-of-your-field", "MMM dd'th' yyyy, HH:mm:ss.SSS", "MMM dd'nd' yyyy, HH:mm:ss.SSS", "MMM dd'st' yyyy, HH:mm:ss.SSS" ] locale => "en" }

[JimP (James Peppercorn)]

@Shaoranlaos

date { match => [ "name-of-your-field", "MMM dd'th' yyyy, HH:mm:ss.SSS", "MMM dd'nd' yyyy, HH:mm:ss.SSS", "MMM dd'st' yyyy, HH:mm:ss.SSS" ] locale => "en" }

Yes, like you have in the match, however, MMM is for Jan, would MMMM be for January?

[JimP (James Peppercorn)]

It worked with four digit MMMM. Thanks!