Logstash dateparse error

Elastic Stack Logstash
2

It does sound like a locale problem. If I run this configuration in an en_US locale

input { generator { count => 1 lines => [ '' ] } }
output { stdout { codec => rubydebug { metadata => false } } }
filter {
    mutate { add_field => { "date1" => "03-Sep-23 15:50:15" } }

    date { match => ["date1", "dd-MMM-yy HH:mm:ss"] target => "dateA" locale => "en_GB.UTF-8" }
    date { match => ["date1", "dd-MMM-yy HH:mm:ss"] target => "dateB" locale => "en_GB" }
    date { match => ["date1", "dd-MMM-yy HH:mm:ss"] target => "dateC" locale => "en_UK" }
    date { match => ["date1", "dd-MMM-yy HH:mm:ss"] target => "dateD" locale => "en" }
}

then I get [dateA], [dateC], [dateD], plus a _dateparsefailure instead of [dateB].

I have no clue how $LANG gets translated into the default locale by the time Ruby calls Java. Using locale => "$LANG" might be an option.

1 Like