I am using logstash to read some logs. I have a log file which the Timestamp only consist of time field, i.e. 08:28:20,500, but no date field. I would like to map it with the datetime of today. How should I do that with date filter.
A line of my log file is like this.
INFO [org.jboss.as.connector.subsystems.datasources] (ServerService Thread Pool -- 27) JBAS010403: Deploying JDBC-compliant driver class org.h2.Driver (version 1.3)>>"C:\CIGNA\jboss\jboss.log"
And my filter part in my logstash .conf file is as shown.
grok {
match => { "message" => '\A%{TIME:Time}%{SPACE}%{WORD:Level}%{SPACE}\[%{JAVACLASS:JavaClass}]%{SPACE}(\(%{GREEDYDATA:Description}\)%{SPACE})?%{GREEDYDATA:Message}'}
}
date {
match => [ "Timestamp" , "HH:mm:sss"]
}
Is there anyone who can help with this issue? Great thanks in advance.