There is a logdate field which I believe parses correctly. Here is an example of the log time format: 2020-08-13 15:57:14,242
Here is my config file below:
input {
beats {
port => "5044"
host => "0.0.0.0"
ssl => false
}
}
filter {
grok {
match => [
#*grok patterns*
]
}
date {
match => ["logdate", "YYYY.MM.dd HH:mm:ss,SSS"]
target => "logdate"
}
}
output {
elasticsearch {
hosts => ["*hosts*"]
index => "logdata-%{+YYYY.MM.dd}"
}
stdout{}
}