Log with no date/time. Manual field not linking to @timestamp

(Blake) #1

I have a set of logs that I would like to input into ES and analyze. The logs are flowing into ES fine but my manual 'date' field is not properly linking to @timestamp. Thus, @timestamp is the ES ingestion time, not the date of the log itself.

date {
      match => ["date", "MM/dd/yyyy"]
      timezone => "America/Chicago"
      target => "@timestamp"

mutate {
  add_field => [ "date", "06/06/2017" ]


     "@timestamp" => 2017-07-21T19:31:56.329Z,
   "Avg Dur(sec)" => 0.0,
       "@version" => "1",
           "host" => "elkTest",
           "time" => "06/06/2017",

"Max Avg Dur(sec)" => 0.0

Is this not the way to do it, is there a better way, or is the format just not matching up with @timestamp.

Any guidance would be appreciated.

(Jordan Sissel) #2

Your configuration and output seem in conflict, so I'm not sure what to advise --

Your config is looking for a field called "date" but your output does not have this, it has a field called "time". Perhaps this is the problem?

(Blake) #3

You are correct....I was writing this mid-update to my config.

Thus my manual field is 'date' in which I'm attempting to populate / overwrite @timestamp.

Sorry for any confusion

July 21st 2017, 15:19:19.651

t date

(Magnus B├Ąck) #4

Filters are evaluted in order so you need to add the field prior to the date filter.

(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.