This is complete filter section:
filter {
grok {
match => {"message" => "(?<logTime>[0-9]{2}:[0-9]{2}:[0-9]{2},[0-9]{3})"}
}
ruby {
code => 'event.set("logTimestamp", Time.now.strftime('%Y-%m-%d') + ' ' + event.get("logTime"))'
}
date {
match => ["logTimestamp", "YYYY-MM-dd HH:mm:ss,SSS"]
timezone => "America/Chicago"
}
}
And Logstash complains about this part('%Y-%m-%d')
I cannot find any examples in docs, not sure what could be wrong with syntax.