How to merge separate date and time to @timestamp


#1

Hi all.
I parse a csv with date and time events. These events has no syslogtime. They are separated in to date and time.
How can I merge date and time to the @timestamp?
I tried some samples with "mutate" and "date" I had found in the forum but without success.

Thats my "rubydebug"

"StartTime" => "18:32:27",
"StartDate" => "16.05.2018",
"@timestamp" => 2018-05-19T00:06:28.173Z,"

Kind regards - Jiona


Comment déclarer une date découpée sur deux champs dans un fichier
#2
mutate { add_field => { "[@metadata][ts]" => "%{StartDate} %{StartTime}" } }
date { match => [ "[@metadata][ts]", "dd.MM.YYYY HH:mm:ss" ] }

#3

Hello Badger.
I'm sorry for my late response (was in holiday).
Your suggestion is the right way, but the time in @timestamp is two hours before. Do you have a solution for that, or can you show me where I can find detailed information about "metadata" and there options?

"StartTime" => "18:32:27",
"StartDate" => "16.05.2018",
"@timestamp" => 2018-05-16T16:32:27.000Z,

Kind regards - Jiona


#4

@timestamp is always UTC. If your logs are not in UTC then specify the timezone option on the date filter.


#5

Thank's. I will be back soon.


#6

In "Kibana => Management => Advanced Settings => dateFormat" the time zone will default recognized by the browser - or can changed to the required Joda.org time zone page.
For me, I do not need to change the timezone.

Thats the "rubydebug" output:

"@timestamp" => 2018-05-16T16:32:27.000Z,
"CallId" => "206522"
"StartTime" => "18:32:27",
"StartDate" => "16.05.2018",

Thats from Kibana output:

@timestamp May 16th 2018, 18:32:27.000
CallId 206522
StartDate 16.05.2018
StartTime 18:32:u5272:

@Badger - Thanks for your support.
Kind regards - Jiona


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.