Logstash how to handle exceptions

Elastic Stack Logstash
21

Something like this should work, assuming there are no spaces padding the fields:

mutate {
    gsub => [ "DATE", "\.", ":"]
}
        	
date {
    match => ["DATE", "d/M/YYYY HH:mm:SS"]
    timezone => "UTC"
}
22

Thank you, but the gsub solution is not what I need....

23

It can help you reduce the number of patterns you need to try in the date filter. I also suspect running a single mutate gsub filter instead of a larger number of date patterns might also be faster, but I have not benchmarked it. If you exclude it you just need to add additional patterns.

24

ok , thank you, not neglect this option , but I would like to have more solutions for this problem to choose the most right for my case

25

I try to use the date{ match=> ......}
this is my filter config :
date {
match => ["Data/Ora Risoluzione TT","%d/%M/%y %H.%m.%s","%d/%M/%y %H:%m:%s", "ISO8601"]
}

this is the exception:
Failed parsing date from field {:field=>"Data/Ora Risoluzione TT", :value=>"11/12/2015 09:42:12", :exception=>"Invalid format: "11/12/2015 09:42:12" is malformed at "/12/2015 09:42:12"", :config_parsers=>"%d/%M/%y %H.%m.%s,%d/%M/%y %H:%m:%s,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Risoluzione TT", :value=>"11/12/2015 12.06.08", :exception=>"Invalid format: "11/12/2015 12.06.08" is malformed at "/12/2015 12.06.08"", :config_parsers=>"%d/%M/%y %H.%m.%s,%d/%M/%y %H:%m:%s,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Risoluzione TT", :value=>"11/12/2015 13:22:56", :exception=>"Invalid format: "11/12/2015 13:22:56" is malformed at "/12/2015 13:22:56"", :config_parsers=>"%d/%M/%y %H.%m.%s,%d/%M/%y %H:%m:%s,ISO8601", :config_locale=>"default=en_US", :level=>:warn}
Failed parsing date from field {:field=>"Data/Ora Risoluzione TT", :value=>"11/12/2015 13:24:14", :exception=>"Invalid format: "11/12/2015 13:24:14" is malformed at "/12/2015 13:24:14"", :config_parsers=>"%d/%M/%y %H.%m.%s,%d/%M/%y %H:%m:%s,ISO8601", :config_locale=>"default=en_US", :level=>:warn}

where am I doing wrong ?

thank you

26

Your date formats are incorrect. Have you tried the ones in the examples provided?

27

now i try with this configuration and don't give me any exception,but the date does not change:
date {
match => ["Data/Ora Risoluzione TT","dd/MM/YYYY HH.mm.ss","dd/MM/YYYY HH:mm:ss", "ISO8601"]
}
for example
input date: 08/12/2015 16:00:18
output date: 08/12/2015 16:00:18

28

i resolved !!
lacked the target!

now my config is this:
date {
match => ["Data/Ora Risoluzione TT","dd/MM/YYYY HH.mm.ss","dd/MM/YYYY HH:mm:ss","ISO8601"]
target => ["Data/Ora Risoluzione TT"]
}