In my settings, JSON is an input data. I tried to use log timestamp as index @timestamp value. Its working for normal json too.
But regex not working for nested json timestamp field match.
Here is my config.
date {
match => ["[a-zA-Z0-9][timestamp]", "YYYY-MM-dd HH:mm:ss"]
target => "@timestamp"
}
Log file example:
{"SRV1": {"timestamp": "2016-09-09 00:30:40", "cpu": 90, "mem": 45, "disk_free": 50}}
{"SRV2": {"timestamp": "2016-09-09 00:30:40", "cpu": 80, "mem": 43, "disk_free": 64}}
Fyi,
This below configuration is working , but I have a 200 servers and its not possible to put 200 entries in the configuration. So I prefer to use regex on match settings.
date {
match => ["[SRV1][timestamp]", "YYYY-MM-dd HH:mm:ss"]
target => "@timestamp"
}
date {
match => ["[SRV2][timestamp]", "YYYY-MM-dd HH:mm:ss"]
target => "@timestamp"
}