How to switch between different log

(Camilo Riviere) #1


I'm wondering how I can go about switching between different logs in logstash? For example, I have one log with a time stamp format of "[2/14/18 13:17:40:147 EST]" and another log with a timestamp format of "04:02:09.538 EST". How could I setup my logstash config to switch between these timestamp formats?


A date filter can match against an array of formats. The documentation gives an example of matching against 3 formats.

match => [ "logdate", "MMM dd yyyy HH:mm:ss",
          "MMM  d yyyy HH:mm:ss", "ISO8601" ]

If I remember correctly EST is ambiguous, so a date filter has no way to interpret it.

(Camilo Riviere) #3

This is great, thank you.

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.