Inconsistent date matching pattern: "M/d/yyyy h:mm:ss a"

Scratching my head with this one...
Note: It does not appear to be the space issue that sometimes plagues single-digit fields.

Any ideas?

Ubuntu 16.04.6 LTS
logstash 7.1.0
openjdk version "1.8.0_212-ojdkbuild"
OpenJDK Runtime Environment (build 1.8.0_212-ojdkbuild-04)
OpenJDK 64-Bit Server VM (build 25.212-b04, mixed mode)

config snippet:
date {
match => [ "Timestamp", "M/d/yyyy h:mm:ss a" ]
timezone => "America/Chicago"
}

Result:
DOES MATCH
"Timestamp": "5/4/2019 11:56:21 PM"
"Timestamp": "5/4/2019 9:06:20 PM"
"Timestamp": "5/4/2019 10:36:19 AM"

DOES NOT MATCH
"Timestamp": "3/10/2019 2:55:12 AM"
"Timestamp": "3/10/2019 2:35:12 AM"

Those are not valid timestamps. On March 10th the US went straight from 1:59:59 to 3:00:00.

Well, That's good to know. I guess the source is wrong. Thanks for the info. I figure out how best to address it at ingest. Thanks again.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.