Logstash, Date plugin not working as expected

I think the problem is in the underlying Joda library that the date filter uses. When it sees H the builder looks for one or two digits -- it is not limited to one. That will consume '94', which is not a valid hour.

You could use mutate+gsub to change the timestamp to "20210128 9.4501065" and then parse that using "yyyyMMdd H.mmssSSS"

1 Like