Logstash parsed the date, and saved as string

Hi, here is my logstash

filter {

csv {
columns => ["nowdate","Total","DIFF"]
convert => {
"Total" => "integer"
"DIFF" => "integer"
}
}

date {
  match => [ "nowdate", "yyyy-mm-dd HH:mm:ss.SSS", "ISO8601" ] 
}	 

When I import it in Kibana, I found the column nowdate is a type of string, although it does saves it as a separate column as 'nowdate'. How should I change to make it saved as 'date' type?

Thanks

First, you may be able to use csv+convert to parse the date since convert accepts date and date_time as options.

Second, you have left the target of the date filter as the default, which is @timestamp. If you want it to overwrite nowdate then add

target => "nowdate"

If you want it to go to both @timestamp and nowdate then do not set the target but instead use mutate+copy after the date filter.

Thanks Badger, use "nowdate" => "date" doesn't work.
But using target made it working.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.