Logging at past date in logstash and elasticsearch

Elastic Stack Logstash
1

I have some logs logged at date say Apr 9, 2017. I am starting the filebeat and ELK on say 11th Apr.

Is there any way, i can log old logs at appropriate timestamp and index (i am creadting day-wise index, say test-2017.04.09, test-2017-04-10 etc.)

2

If you use a date filter it'll handle it automatically.

3

I have below config in my logstash filter

grok {
   match => { "message" => "%{TIMESTAMP_ISO8601:logdate}%{ISO8601_TIMEZONE:timezone} %{JAVACLASS:class} %{SYSLOG5424SD:logLevel}"}
 }
 date {
   match => ["logdate", "YYYY-MM-dd'T'HH:mm:ss.SSS"]
   target => "@timestamp"
   locale => "en"
 }

My log message is in this format:

2017-04-06T09:16:07.274-0500 c.t.i.s.b.MessageInterpreter [ERROR] message logged

I want timestamp to be April 6th 2017, 9:16.607.274, but it appears 5:30 hours ahead of that in kibana. The timestamp that appears there is April 6th 2017, 14:46.607.274

4

LS assumes that time is in UTC, if it is not then you need to use the timezone option.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.