Integrate formated date to elasticsearch


(Sylfaen) #1

Hey

I'm trying to integrate date format like "Fri Jan 02 17:34:45 CET 2017" but logstash send me error message with malformated date at "CET 2017"

I used the response from here but

"exDate": {
"type": "date",
"format": "E MMM d H:m:s z Y"
},

isn't working. Is there a specific thing with CET ? How can I map my date ?

Thanks!


(Sylfaen) #2

Resolved by removing CET from the field and matching date with timezone :

if ([expDt]) {
    mutate {
      gsub => ["[expDt]", "CET", ""]
    }
    date {
      match => ["[expDt]", "E MMM d H:m:s  Y"]
      timezone => "CET"
      target => "[expDt]"
    }
  }

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.