Logstash date filter match pattern

Elastic Stack Logstash
1

Hi,
I have a logstash config that pulls from jdbc and pushes it to elasticsearch based on the select statement where my tracking column is an attribute mod_dttm (Example: 23-JAN-20 12.23.28.771000000 PM).

So, I created a filter as below:

filter {
mutate {
    add_field => {
        "[@metadata][mod_dttm]" => "%{mod_dttm}"
    }
}
date    {
    locale => "en"
    timezone => "UTC"
    match => [ "mod_dttm", "dd-MMM-yy hh.mm.ss.SSSSSSSSS a" ]
    target => "@timestamp"
}
}

I am getting _dateparsefailure. Can somebody please help. When I see/search the documents, the mod_dttm is in this format in the elasticsearch "yyyy-MM-dd'T'HH24:mm:ss.SSS'Z'"

2

hh can have values from 0 to 11. 12 is not valid. Use HH instead.

3

Still getting the same error _dateparsefailure

4 
input { generator { count => 1 lines => [ '' ] } }
filter {
    mutate { add_field => { "mod_dttm" => "23-JAN-20 12.23.28.771000000 PM" } }
    date    {
        locale => "en"
        timezone => "UTC"
        match => [ "mod_dttm", "dd-MMM-yy HH.mm.ss.SSSSSSSSS a" ]
        target => "@timestamp"
    }
}
output { stdout { codec => rubydebug { metadata => false } } }

gets me

"@timestamp" => 2020-01-23T12:23:28.771Z,

So something is not as you describe it.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.