This was explained here.
Credits to Badger
Here is a sample:
input {
generator {
# message => [ "2024-08-12T09:40:31.098Z" ]
message => [ "2024-08-12T17:40:31.098422413+08:00" ]
count => 1
}
}
output {
stdout {codec => rubydebug}
}
filter {
date {
match => [ "message", "yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSSZ"] # "ISO8601"
timezone => "Asia/Shanghai"
target => "@timestamp"
}
ruby {
code => "event.set('[longformat]', LogStash::Timestamp.new(event.get('[message]')) )"
}
mutate { remove_field => ["@version", "event", "host"] }
}
Output:
{
"message" => "2024-08-12T17:40:31.098422413+08:00",
"@timestamp" => 2024-08-12T09:40:31.098Z,
"longformat" => 2024-08-12T09:40:31.098422413Z
}