Issue with dates parsing

Elastic Stack Logstash
1

Sorry if this has been asked a million times. I am stuck I checked out every post:

I have a scheduled logstash configuration from Microsoft SQL Server. Date is in the following example format:

2016-07-30T02:25:06.000Z

In my logstash configuration, I have this and tried many different options with failure.

filter {
date {
match => ["tur_start_time","YYYY-MM-dd HH:mm:ss,SSS"]
}
}

Please help

Currently get the following error:

Failed parsing date from field {:field=>"tur_start_time", :value=>"2016-07-30T02:18:48.000Z", :exception=>"cannot convert instance of class org.jruby.RubyObject to class java.lang.String", :config_parsers=>"YYYY-MM-dd HH:mm:ss,SSS", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"tur_start_time", :value=>"2016-07-30T03:04:27.000Z", :exception=>"cannot convert instance of class org.jruby.RubyObject to class java.lang.String", :config_parsers=>"YYYY-MM-dd HH:mm:ss,SSS", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"tur_start_time", :value=>"2016-07-30T04:25:18.000Z", :exception=>"cannot convert instance of class org.jruby.RubyObject to class java.lang.String", :config_parsers=>"YYYY-MM-dd HH:mm:ss,SSS", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"tur_start_time", :value=>"2016-07-30T02:54:02.000Z", :exception=>"cannot convert instance of class org.jruby.RubyObject to class java.lang.String", :config_parsers=>"YYYY-MM-dd HH:mm:ss,SSS", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"tur_start_time", :value=>"2016-07-30T02:25:06.000Z", :exception=>"cannot convert instance of class org.jruby.RubyObject to class java.lang.String", :config_parsers=>"YYYY-MM-dd HH:mm:ss,SSS", :config_locale=>"default=en_US", :level=>:warn}

Wayne

2

Not sure I understand why. However, this solved it:

filter {
 mutate {
    convert => [ "tur_start_time", "string" ]
 }

 date {
     match => [ "tur_start_time", ISO8601 ]
     target => "@timestamp"
 }
}
1 Like