Hello,
When creating an index you must pay attention to the time field that you choose in the 2nd step you must choose the logdate, not the indexing time.
i have done a test with this log line in case you have to change only the timezone :
**2021-10-12T21:05:55.825681|aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa**
Filter :
filter {
grok {
match => {
"message" => [
"^%{TIMESTAMP_ISO8601:logdate}\|%{GREEDYDATA}",
"%{GREEDYDATA:FAILPARSE}"
]
}
}
date {
match => [ "logdate", "ISO8601", "yyyy-MM-dd HH:mm:ss.SSSSSS" ]
timezone => "GMT"
target => "TIMESTAMP"
}
}
OUTPUT :
{
"TIMESTAMP": "2021-10-12T21:05:55.825Z",
"logdate": "2021-10-12T21:05:55.825681",
"message": "2021-10-12T21:05:55.825681|aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}