filter {
date {
match => ["logtime1","yyyymmdd HH:mm:ss,SSS"]
match => ["logtime2","MMM dd, yyyy hh:mm:ss a"]
target => "logtime"
locale => "cn"
timezone => "+08:00"
}
}
use this
20181107 00:00:11,918
Dec 07, 2018 12:01:01 AM
logtime field can't have data...