How to override logstash @timestamp value with my date time field from the logs

Date-Filter expects a pattern matching your timeformat in the match-part.

Your pattern yyyy-MM-dd HH:mm:ss,SSS can't match your timestamp Dec 12 13:45:43.

The pattern you need should look like the following:
match => [ "Call_Time", "MMM dd HH:mm:ss" ]

but: You don't have a year in your logfile, so Logstash will default to the year when the Logstash process started. More information here Syslog date without year.

1 Like