You probably need to omit the "Z" token in the pattern. Try this:
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss +0800" ]
timezone => "UTC"
}
If that works, consider removing "+0800" from the pattern and from the timestamp
field.
You probably need to omit the "Z" token in the pattern. Try this:
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss +0800" ]
timezone => "UTC"
}
If that works, consider removing "+0800" from the pattern and from the timestamp
field.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.