Logstash date filter plugin adds _dateparsefailure tag on event data from JDBC

[nilei]

Dear all,

I fetch data from a MySQL database via the JDBC input plugin. Here is an excerpt from the SQL result:

+---------------------------+--------------------------+
| History.Created.DateValue | History.Number.KeyValue  |
+---------------------------+--------------------------+
| 2021-02-26 13:19:20       | 2015071510123456         |
| 2022-03-15 12:50:17       | 2015071510123456         |
+---------------------------+--------------------------+

There are more data fields, but History.Created.DateValue is the only date field in the records.

In Logstash, I want to use the History.Created.DateValue field for populating the @timestamp value.

    # Take "History.Created.DateValue" field value as timestamp value
    date {
        match => ["History.Created.DateValue", "yyyy-MM-dd'T'HH:mm:ss.SSSZ"]
    }

I have tried other formats as well:

yyyy-MM-dd HH:mm:ss
or
ISO8601
or
yyyy-MM-dd'T'HH:mm:ss.SSSZ (as in the example above)
or
yyyy-MM-ddTHH:mm:ss.SSSZ (but there comes an "Illegal pattern component: T" error)
or
yyyy-MM-dd HH:mm:ss.SSSZ (with space between dd and HH)

Unfortunately all without success. Logstash always adds a tag with _dateparsefailure as value. Interestingly, I can use the date data in Kibana, for example, as desired. Except that @timestamp didn't get the right value, of course.

In the log, the output is shown to me like this:

{
	"History.Number.KeyValue":"2015071510123456",
	"@timestamp":"2022-03-16T10:54:00.508Z",
	"@version": "1",
	"History.Created.DateValue":"2021-02-26T13:19:20.000Z",
	"tags":["_dateparsefailure"]
}

I just can't figure out what I did wrong here and I appreciate any help.

By the way, I have about 10 other pipeline configs in which I use the Date plugin the same way and everything works flawlessly. Only there I don't use a database via JDBC as source - that's the only difference to the other pipeline configurations.

-- Cheers, Nils

[Badger]

This, perhaps?

[nilei]

So simple, and so right.

Why didn't I find this myself during my research??? Well, that was at least the right hint!

Thank you very much!

-- Cheers, Nils