How to parse timestamp windows event log

Elastic Stack Logstash
1

Hello to all,

I have a problem with parsing this field(event.created) with the timestamp, here is the screen:
image

this is the filter I created:
image

thanks

2

Which part of this looks incorrect? It appears that field is being parsed and you are seeing it in Kibana as such.

I would add quotes around ISO8601 but if that was throwing an error I don't think your data in Kibana would look like it was parsed.

filter {
 date {
  match => [ "[event][created]", "ISO8601" ]
 }
}
3

my goal is to parse the event.created date in the timestamp, here is the example screenshot.

image
image1168×131 7.62 KB

Unfortunately, with the change you suggested it doesn't work

4

Understand. Didn't see the @timestamp field in other screenshot.

Have you checked the Logstash logs? If the parsing of the date is failing you should be getting a WARN.

Another thing to check is the value of that field. If it's being create by a filebeat then it should be in ISO8601 which looks like 2016-05-23T08:05:34.857Z. I would just verfiy the value looks correct.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.