I can't record the current date from the log string in the @timestamp field

[vanro (Mikhail)]

Hello, I can't record the current date from the log string in the @timestamp field and convert the time field from the string type to the date type. Can you tell me what I'm doing wrong? My configuration is shown below..

if [type] == "bl" {
		grok {
			patterns_dir => ["/etc/logstash/patterns"]
			match => { "message" => "%{FIRESEC_BL_GENERAL}" }
		}
		date {
			match => ["time", "dd MMM yyyy hh:mm:ss.SSS"]
			target => "time"
		}
		date {
			match => ["time", "dd MMM yyyy hh:mm:ss.SSS"]
			target => "@timestamp"
		}
	}

My patterns:
FIRESEC_TIME %{MONTHDAY} %{MONTH} %{YEAR} %{TIME}
FIRESEC_BL_GENERAL %{FIRESEC_TIME:time} [(?<module_name>(?:[^-]+|-(?:$|[^\d])))-(?<module_version>[^]])][(?<alert_source>[^]])] (?<alert_type>[^ ]) (?<alert_message>[^\n^.])

[leandrojmp (Leandro Pereira)]

Try to change your date filter, use HH instead of hh.

Change it to: "dd MMM yyyy HH:mm:ss.SSS".

Lowercase h is used when you have AM/PM time, it means clockhour of halfday (1~12).

When you have the time with 24 hour format you need to use HH.

[vanro (Mikhail)]

Thank you very much, it helped me