Logstash format for date format Dec 04 21:24:03.238 2018

Elastic Stack Logstash
1

Currently my log file contains the date format in Dec 04 21:24:03.238 2018 and the loglines are being tagged as dateparsefailure. Following is the date filter i have added in my logstash conf

date{
match => ["LogDateTime","yyyy-MM-dd HH:mm:ss","MMM dd hh:mm:ss.SSS yyyy","MM/dd/yyyy hh:mm:ss.SSS aa", "yyyy-MM-dd HH:mm:ss,SSS", "yyyy-MM-dd HH:mm:ss.SSS"]
timezone => "Asia/Kolkata"
target => "@timestamp"
}

Any idea why this is being tagged as dateparsefailure ???

2

It looks like this pattern should match that date format.
Try removing all other patterns and just use this one.

3

Thanks Andy for the reply. You were right the pattern you mentioned matched but it should contain HH instead of hh. I did the change and looks like it worked. Will keep you posted if the problem appears again.

4

ARgh! Of course!
Glad you found it :slight_smile: