Logstash date filter plugin adds _dateparsefailure tag on event data from JDBC

Dear all,

I fetch data from a MySQL database via the JDBC input plugin. Here is an excerpt from the SQL result:

| History.Created.DateValue | History.Number.KeyValue  |
| 2021-02-26 13:19:20       | 2015071510123456         |
| 2022-03-15 12:50:17       | 2015071510123456         |

There are more data fields, but History.Created.DateValue is the only date field in the records.

In Logstash, I want to use the History.Created.DateValue field for populating the @timestamp value.

    # Take "History.Created.DateValue" field value as timestamp value
    date {
        match => ["History.Created.DateValue", "yyyy-MM-dd'T'HH:mm:ss.SSSZ"]

I have tried other formats as well:

yyyy-MM-dd HH:mm:ss
yyyy-MM-dd'T'HH:mm:ss.SSSZ (as in the example above)
yyyy-MM-ddTHH:mm:ss.SSSZ (but there comes an "Illegal pattern component: T" error)
yyyy-MM-dd HH:mm:ss.SSSZ (with space between dd and HH)

Unfortunately all without success. Logstash always adds a tag with _dateparsefailure as value. Interestingly, I can use the date data in Kibana, for example, as desired. Except that @timestamp didn't get the right value, of course.

In the log, the output is shown to me like this:

	"@version": "1",

I just can't figure out what I did wrong here and I appreciate any help.

By the way, I have about 10 other pipeline configs in which I use the Date plugin the same way and everything works flawlessly. Only there I don't use a database via JDBC as source - that's the only difference to the other pipeline configurations.

-- Cheers, Nils

This, perhaps?

1 Like

So simple, and so right.

Why didn't I find this myself during my research??? Well, that was at least the right hint!

Thank you very much!

-- Cheers, Nils

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.