Hi,
I have a logstash config that pulls from jdbc and pushes it to elasticsearch based on the select statement where my tracking column is an attribute mod_dttm (Example: 23-JAN-20 12.23.28.771000000 PM).
So, I created a filter as below:
filter {
mutate {
add_field => {
"[@metadata][mod_dttm]" => "%{mod_dttm}"
}
}
date {
locale => "en"
timezone => "UTC"
match => [ "mod_dttm", "dd-MMM-yy hh.mm.ss.SSSSSSSSS a" ]
target => "@timestamp"
}
}
I am getting _dateparsefailure. Can somebody please help. When I see/search the documents, the mod_dttm is in this format in the elasticsearch "yyyy-MM-dd'T'HH24:mm:ss.SSS'Z'"