Logstash as a parser for data in column

INPUT

"TIME" => "200254300",
"DATE" => "211223",

above value have a number format
how can I change to the timestamp, I've tried by following code but got [_dateparsefailure] in tag


 add_field => { "ts" => "%{DATE} %{TIME}" }
  
  }
  
 
mutate {  
			remove_field => ["message"] 
      }
date { match => ["ts", "yyMMdd HH:mm:ss:SSS", "ISO8601"]
       
      timezone => "Europe/Berlin"
      target => "@timestamp"
      remove_field => ["ts"]
      }
}

Your [ts] field is going to contain "211223 200254300", so that is not going to match. You could try

    date { match => [ "ts", "yyMMdd HHmmssSSS" ] ... }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.