Alvin82
November 19, 2015, 1:08pm
1
I'm using date plugin, but i'm not able to match this timestamp
log_ts = 2015-11-19-11:14:23.8704
If i use this snippet code in the conf file
date {
match => ["log_ts", "yyyy-MM-dd-HH:mm:ss.SSSS"]
}
I obtain this exception
arsing_exception", "reason"=>"failed to parse [log_ts]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"2015-11-19-11:14:23.8704\" is malformed at \"-11:14:23.8704\""}}}}, :level=>:warn, :file=>"logstash/outputs/elasticsearch.rb", :line=>"369", :method=>"submit"}
Why i have this error?How can i match that timestamp?
Works fine for me (Logstash 1.5.3):
$ cat test.config
input { stdin { } }
output { stdout { codec => "rubydebug" } }
filter {
date {
match => ["message", "yyyy-MM-dd-HH:mm:ss.SSSS"]
}
}
$ echo '2015-11-19-11:14:23.8704' | /opt/logstash/bin/logstash -f test.config
Logstash startup completed
{
"message" => "2015-11-19-11:14:23.8704",
"@version" => "1",
"@timestamp" => "2015-11-19T10:14:23.870Z",
"host" => "lnxolofon"
}
Logstash shutdown completed
pierre
(passat)
December 15, 2016, 12:57pm
3
i have this :
01-11-2015;17:41:01;641
filter {
grok {
break_on_match => "false"
match => { "message" => '%{DATA}%{DATE_EU:Date};%{TIME:Date};%{NUMBER:Nombre}%{DATA}'}
}
}
but my date en heure = string
i want date so i use
date {
match => [ "Date", "dd MM YYYY HH:mm:ss" ]
}
but i have
{
"_index": "logstash-2016.12.15",
"_type": "Vmware",
"_id": "AVkCgGy96I_tcz_3yhMg",
"_score": null,
"_source": {
"Nombre": 751,
"path": "/var/log/StatVM/test10.log",
"@timestamp ": "2016-12-15T12:41:27.524Z",
"@version ": "1",
"host": "localhost.localdomain",
"message": "14-12-2016;11:20:01;751",
"type": "Vmware",
"Date": [
"14-12-2016",
"11:20:01"
],
"tags": [
"_dateparsefailure",
"_grokparsefailure"
]
},
"fields": {
"@timestamp ": [
1481805687524
]
},
"sort": [
1481805687524
]
}
},
"fields": {
"@timestamp ": [
1481804404819
]
},
"sort": [
1481804404819
]
}
@pierre , please start a new thread for your unrelated question.