Logstash ignores my if condition

Elastic Stack Logstash
1

Some of input log messages are in JSON format. I would like to use "time" value as "@timestamp".

This is an example of log message in JSON format :

{
  "level":30,
  "time":1531171074631,
  "msg":"hello world",
  "pid":657,
  "hostname":"Davids-MBP-3.fritz.box",
  "v":1
}

Here is my logstash configuration file:

input {
  beats {
    ...
  }
}

filter{
  json {
    source => "message"
    target => "json_message"
    skip_on_invalid_json => true
    tag_on_failure => [""]
  }

  if [json_message][time] {
    mutate {
      convert => { "[json_message][time]" => "string" }
    }

    date {
      match => ["[json_message][time]", "UNIX"]
      timezone => "UTC"
      target => "@timestamp"
    }
  }
}

output {
  elasticsearch {
    ...
  }
}

I have no luck with this configuration: key [json_message][time] still has number format and it looks like it is not used as @timestamp.

Can someone point to my mistake?

2

Sorry, i should use "UNIX_MS" not "UNIX" time format in logstash configuration file.

1 Like
3

Thanks for sharing the solution :smiley:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.